From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 00636FD9E1C for ; Fri, 27 Feb 2026 05:00:07 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 5D5C010EA33; Fri, 27 Feb 2026 05:00:07 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="dkHDT+Ch"; dkim-atps=neutral Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) by gabe.freedesktop.org (Postfix) with ESMTPS id 25C4510E239 for ; Fri, 27 Feb 2026 05:00:04 +0000 (UTC) Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-824b5f015bcso1966557b3a.1 for ; Thu, 26 Feb 2026 21:00:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772168404; x=1772773204; darn=lists.freedesktop.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TqIhYcF+CYSjiR8zV9a6G8BIYgFMg1pnmFFZ2FA8I4I=; b=dkHDT+Ch0H9GB4VFxcvSTIcJDLmcpJ1pQvzhGMdXCtMfuvi5F56hw12iJVI798FkGN QvNUufpRs1y/X9gWrtbWAjAj182Msmp9Ty45ZAsl9D7FRQ7DfeQSvMBp+Ex/KdeFtpAq ES7LaUykODpFdZRuSb6nvm9wzuSsHQrSUsJh0GtrzfYMh6Zgf4zNsRUB3rWCYOOeoKn6 ok8BFvxK1Ny8um8Woe/IP+KhmIUgKPdkrshCuEer+9X/BwZ9N2R/dltr8l+3bMfO/Cvr ep8MLym6FALJkfa0HWGWeJD9PooMOv/SPl5o1UK8SdLFolwxvIP5gpGKfXIEqKBwwL5i bTkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772168404; x=1772773204; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=TqIhYcF+CYSjiR8zV9a6G8BIYgFMg1pnmFFZ2FA8I4I=; b=CSQIF8EQ20+sg7RUX0oR20+LYuCcVjo3l78ZqBna3/ZV1aa27jdESusMldhEL60Upa qVJvUScib1MZqo42FyCAMgiO7+yY539aQDj9+EDaGWZf9GkBJQC22c8elVbLhKyjBT/h FpxruPXf0/NgOA4g3pMkFc9iccQmOgDXfq06PgG/fyxoSu1++AQP0uT8nmW/T2FY1GHm A5V2RyFhZiTPOZiHwF/Y3dMBiNTLO9SO09H4VlPU4PHtugaNgW393048KpEtMIZmVPv2 1GnBrlUSJ2S6RyDjnd/69Zt4rvcOB8IllK+63Nt3bWw9vOTTt3uxMILqSqD/EM/kLVLJ Wd3w== X-Forwarded-Encrypted: i=1; AJvYcCVJ4ypP5r3veELEK+xP5vYPeWpeOAo/+IOtN2aXuOJelj38ac01Ti/yuPcCosg4ykAABDXVc9cC/kc=@lists.freedesktop.org X-Gm-Message-State: AOJu0YxUaMU+U/YMfiHlcohAVJeVqf3BVccKXpzA4o19ifid+27mkcup ZuRs2fKnO3lFObs81fe45rSXbfffupj1RHfrD6UWXWRGq1j1AsNaoCsp X-Gm-Gg: ATEYQzxCk/DbaQ8wlv/azrkCjQl2idMpDRphazRX/ilNWegLamK5l3BOfdp11ccpOcM qi+FpPWCPBCAFbGj7q3a+XjsnRcBe8V38SSURBmle0SvwDW3Zk/QXQ1t76FkVKmcSuVeqGq1oDn 0oa9Il0uuZ/H8VqMITMVyl7Y0BN1DavfNloo71SH+8q+p0zHr0P4LkAQ4n91ySny7MOUNG3UbyJ lPjHprO1dJcQ4Yvw/rcyUA7bnnrRcl1/Q9hFHJXL9z7A84g3ZFaJjR1laKadBxpVPQPkJgBnXKc j342fLM9qa0cOG+u4CN7Q7vhFmxX2Uces/ivQYOEM54sA/iRZugwpiQsc7LZ4/3pJvC/rFidVZi hyaNFVP3+Y1D8GgA5uXknwnACux0H6t6asOPpftbo7PKVTb9/tX8ldizZ664sjTM52wxjU7FGgp EeDrp7JNUfX6maqmB2I4psAPkT08HoeyoEiIiIyKXg40dh2oX0wg== X-Received: by 2002:a05:6a00:1a0b:b0:827:2c11:f137 with SMTP id d2e1a72fcca58-8274da7a4f0mr1480551b3a.62.1772168403587; Thu, 26 Feb 2026 21:00:03 -0800 (PST) Received: from name2965-Precision-7820-Tower.. ([175.201.112.127]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82739d94de6sm3966543b3a.24.2026.02.26.21.00.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Feb 2026 21:00:03 -0800 (PST) From: Jeongjun Park To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , Inki Dae , Seung-Woo Kim , Kyungmin Park , David Airlie , Simona Vetter , Krzysztof Kozlowski , Alim Akhtar , dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-samsung-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Jeongjun Park Subject: [PATCH 6.6.y 2/3] drm/exynos: vidi: fix to avoid directly dereferencing user pointer Date: Fri, 27 Feb 2026 13:59:52 +0900 Message-Id: <20260227045953.165751-3-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260227045953.165751-1-aha310510@gmail.com> References: <20260227045953.165751-1-aha310510@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" [ Upstream commit d4c98c077c7fb2dfdece7d605e694b5ea2665085 ] In vidi_connection_ioctl(), vidi->edid(user pointer) is directly dereferenced in the kernel. This allows arbitrary kernel memory access from the user space, so instead of directly accessing the user pointer in the kernel, we should modify it to copy edid to kernel memory using copy_from_user() and use it. Cc: Signed-off-by: Jeongjun Park Signed-off-by: Inki Dae --- drivers/gpu/drm/exynos/exynos_drm_vidi.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c index d0e394397eca..576d79ebe9a8 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c +++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c @@ -252,19 +252,26 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data, if (vidi->connection) { struct edid *raw_edid; + struct edid edid_buf; + void *edid_userptr = u64_to_user_ptr(vidi->edid); - raw_edid = (struct edid *)(unsigned long)vidi->edid; - if (!drm_edid_is_valid(raw_edid)) { + if (copy_from_user(&edid_buf, edid_userptr, sizeof(struct edid))) + return -EFAULT; + + if (!drm_edid_is_valid(&edid_buf)) { DRM_DEV_DEBUG_KMS(ctx->dev, "edid data is invalid.\n"); return -EINVAL; } - ctx->raw_edid = drm_edid_duplicate(raw_edid); - if (!ctx->raw_edid) { + + raw_edid = drm_edid_duplicate(&edid_buf); + + if (!raw_edid) { DRM_DEV_DEBUG_KMS(ctx->dev, "failed to allocate raw_edid.\n"); return -ENOMEM; } + ctx->raw_edid = raw_edid; } else { /* * with connection = 0, free raw_edid --