From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFCC5839E4; Wed, 7 Aug 2024 15:05:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723043133; cv=none; b=nNKQhIF4e7wOLYOTtLciGCbSxQX4hDCoIxg61lxVcv98XrZcQzm2d4a5qNnwCYxwgT7fCi1/mH9IbpLRK3L6wGXQtJVy9u8d6kbECjslIrqT2C+4nilW/nuOyJTRegeA5VvoxAeS0ZAhS56pYBG3SwVDhdP18RKVTO08lakqC+Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723043133; c=relaxed/simple; bh=vNW1feAjwrsbBzwk3Q4OJruaBqsqfqyYcZZNspG/NHw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=qcJJhSlirZG3et2pdfwFzT8QKGJZn/eN8af7p6T/9bXtFoPB3c9lUrO+nI44Bp1G/8oChxnEl0ow2qmzXx1fhLbjyMcHQN8HGUbiuGTsBY8busEtYBRPf79DA6KEOLIoAyQ3Hx1FOxv/vzW72//5yaFmUPYKCDOt3BXH+rZTEVU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QynBbuPb; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QynBbuPb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81CC4C4AF0D; Wed, 7 Aug 2024 15:05:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1723043132; bh=vNW1feAjwrsbBzwk3Q4OJruaBqsqfqyYcZZNspG/NHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QynBbuPbnZaiQM4pL0QNKJqiXRWM+3FiZp2xXcD5Ub1fVypEd8r7D81/YV9EEfbWl CeDvELzdEAYZ7lrbgtM7SR/++thiEDC/9Hfgac+Ccs5qP9rvHO3FzD9zp5bNJyPuHN 9Iq27YN1+JCVrSk4hEjPzzEOy9HvwInwhjmNtU10= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tvrtko Ursulin , =?UTF-8?q?Ma=C3=ADra=20Canal?= , Iago Toral Quiroga , Thomas Zimmermann Subject: [PATCH 6.10 101/123] drm/v3d: Validate passed in drm syncobj handles in the timestamp extension Date: Wed, 7 Aug 2024 17:00:20 +0200 Message-ID: <20240807150024.120662503@linuxfoundation.org> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240807150020.790615758@linuxfoundation.org> References: <20240807150020.790615758@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tvrtko Ursulin commit 023d22e8bb0cdd6900382ad1ed06df3b6c2ea791 upstream. If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix it by checking handle was looked up successfully or otherwise fail the extension by jumping into the existing unwind. Signed-off-by: Tvrtko Ursulin Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-5-tursulin@igalia.com (cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3) Signed-off-by: Thomas Zimmermann Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/v3d/v3d_submit.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c index 50be4e8a7512..9a3e32075ebe 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -498,6 +498,10 @@ v3d_get_cpu_timestamp_query_params(struct drm_file *file_priv, } job->timestamp_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync); + if (!job->timestamp_query.queries[i].syncobj) { + err = -ENOENT; + goto error; + } } job->timestamp_query.count = timestamp.count; @@ -552,6 +556,10 @@ v3d_get_cpu_reset_timestamp_params(struct drm_file *file_priv, } job->timestamp_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync); + if (!job->timestamp_query.queries[i].syncobj) { + err = -ENOENT; + goto error; + } } job->timestamp_query.count = reset.count; @@ -616,6 +624,10 @@ v3d_get_cpu_copy_query_results_params(struct drm_file *file_priv, } job->timestamp_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync); + if (!job->timestamp_query.queries[i].syncobj) { + err = -ENOENT; + goto error; + } } job->timestamp_query.count = copy.count; -- 2.46.0