From f60859522a830c4d31337592b673799c3b914d0a Mon Sep 17 00:00:00 2001 From: Thierry Reding Date: Mon, 3 Nov 2014 11:14:14 +0100 Subject: [PATCH] drm: Sanitize DRM_IOCTL_MODE_CREATE_DUMB input Some drivers treat the pitch and size fields as inputs and will use them as minima provided by userspace so that they are only overwritten if the minimal requirements of the driver exceed them. This can cause strange behaviour when applications don't zero out these fields, causing whatever was on the stack to be passed to the IOCTL. In a typical case this would become visible as a failed allocation if the pitch or size were unusually high. But this could also cause more subtle bugs like overallocating dumb framebuffers. To prevent drivers from misusing these values, make the DRM core zero out the pitch and size fields before passing the structure to the driver implementation. While at it, also set the output handle field to zero for good measure, even though it's less likely to be abused. Reviewed-by: Daniel Vetter Signed-off-by: Thierry Reding --- drivers/gpu/drm/drm_crtc.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index e79c8d3700d8..e2ea1512eb44 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -4769,6 +4769,16 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, if (PAGE_ALIGN(size) == 0) return -EINVAL; + /* + * handle, pitch and size are output parameters. Zero them out to + * prevent drivers from accidentally using uninitialized data. Since + * not all existing userspace is clearing these fields properly we + * cannot reject IOCTL with garbage in them. + */ + args->handle = 0; + args->pitch = 0; + args->size = 0; + return dev->driver->dumb_create(file_priv, dev, args); }