tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/v3d: Validate passed in drm syncobj handles in the performance extension

If userspace provides an unknown or invalid handle anywhere in the handle
array the rest of the driver will not handle that well.

Fix it by checking handle was looked up successfully or otherwise fail the
extension by jumping into the existing unwind.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job")
Cc: Maíra Canal <mcanal@igalia.com>
Cc: Iago Toral Quiroga <itoral@igalia.com>
Cc: stable@vger.kernel.org # v6.8+
Reviewed-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-6-tursulin@igalia.com

authored by

Tvrtko Ursulin and committed by
Maíra Canal a546b7e4 8d1276d1

+8
+8
drivers/gpu/drm/v3d/v3d_submit.c
··· 710 710 } 711 711 712 712 job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync); 713 + if (!job->performance_query.queries[i].syncobj) { 714 + err = -ENOENT; 715 + goto error; 716 + } 713 717 } 714 718 job->performance_query.count = reset.count; 715 719 job->performance_query.nperfmons = reset.nperfmons; ··· 794 790 } 795 791 796 792 job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync); 793 + if (!job->performance_query.queries[i].syncobj) { 794 + err = -ENOENT; 795 + goto error; 796 + } 797 797 } 798 798 job->performance_query.count = copy.count; 799 799 job->performance_query.nperfmons = copy.nperfmons;