* [PATCH] drm: avoid passing null pointer to memset
@ 2012-10-09 17:50 Rodrigo Vivi
2012-10-09 18:03 ` Chris Wilson
2012-10-09 19:56 ` Rodrigo Vivi
0 siblings, 2 replies; 4+ messages in thread
From: Rodrigo Vivi @ 2012-10-09 17:50 UTC (permalink / raw)
To: dri-devel
When cmd isn't IOC_IN | IOC_OUT a null "kdata" goes to "memset", which dereferences it.
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
---
drivers/gpu/drm/drm_drv.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 1490e76..5945920 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -452,8 +452,16 @@ long drm_ioctl(struct file *filp,
retcode = -EFAULT;
goto err_i1;
}
- } else
+ } else {
+ if (!kdata) {
+ kdata = kmalloc(usize, GFP_KERNEL);
+ if (!kdata) {
+ retcode = -ENOMEM;
+ goto err_i1;
+ }
+ }
memset(kdata, 0, usize);
+ }
if (ioctl->flags & DRM_UNLOCKED)
retcode = func(dev, kdata, file_priv);
--
1.7.11.4
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] drm: avoid passing null pointer to memset
2012-10-09 17:50 [PATCH] drm: avoid passing null pointer to memset Rodrigo Vivi
@ 2012-10-09 18:03 ` Chris Wilson
2012-10-09 19:56 ` Rodrigo Vivi
1 sibling, 0 replies; 4+ messages in thread
From: Chris Wilson @ 2012-10-09 18:03 UTC (permalink / raw)
To: Rodrigo Vivi, dri-devel
On Tue, 9 Oct 2012 14:50:46 -0300, Rodrigo Vivi <rodrigo.vivi@gmail.com> wrote:
> When cmd isn't IOC_IN | IOC_OUT a null "kdata" goes to "memset", which dereferences it.
>
usize should be 0 in that case, since the ioctl is neither copying data
in or out, for example I915_GEM_THROTTLE. To be on the safe side:
if (IOC_IN | IOC_OUT) { /* blah */ } else usize = 0;
-Chris
--
Chris Wilson, Intel Open Source Technology Centre
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH] drm: avoid passing null pointer to memset
2012-10-09 17:50 [PATCH] drm: avoid passing null pointer to memset Rodrigo Vivi
2012-10-09 18:03 ` Chris Wilson
@ 2012-10-09 19:56 ` Rodrigo Vivi
2012-10-10 12:52 ` Chris Wilson
1 sibling, 1 reply; 4+ messages in thread
From: Rodrigo Vivi @ 2012-10-09 19:56 UTC (permalink / raw)
To: dri-devel
When cmd isn't IOC_IN | IOC_OUT a null "kdata" goes to "memset", which dereferences it.
v2: simpler version just using usize = 0 instead of allocating useless memory
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
---
drivers/gpu/drm/drm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 1490e76..f72dce5 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -444,7 +444,8 @@ long drm_ioctl(struct file *filp,
}
if (asize > usize)
memset(kdata + usize, 0, asize - usize);
- }
+ } else
+ usize = 0;
if (cmd & IOC_IN) {
if (copy_from_user(kdata, (void __user *)arg,
--
1.7.11.4
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] drm: avoid passing null pointer to memset
2012-10-09 19:56 ` Rodrigo Vivi
@ 2012-10-10 12:52 ` Chris Wilson
0 siblings, 0 replies; 4+ messages in thread
From: Chris Wilson @ 2012-10-10 12:52 UTC (permalink / raw)
To: Rodrigo Vivi, dri-devel
On Tue, 9 Oct 2012 16:56:58 -0300, Rodrigo Vivi <rodrigo.vivi@gmail.com> wrote:
> When cmd isn't IOC_IN | IOC_OUT a null "kdata" goes to "memset", which dereferences it.
>
> v2: simpler version just using usize = 0 instead of allocating useless memory
>
> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
Presuming that coverity is smart enough not to complain about
memcpy(NULL, src, 0),
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
-Chris
--
Chris Wilson, Intel Open Source Technology Centre
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-10-10 12:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-10-09 17:50 [PATCH] drm: avoid passing null pointer to memset Rodrigo Vivi
2012-10-09 18:03 ` Chris Wilson
2012-10-09 19:56 ` Rodrigo Vivi
2012-10-10 12:52 ` Chris Wilson
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.