github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-25 23:52:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fbdev: smscufx: properly copy ioctl memory to kernelspace

Browse Source 
The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from
userspace to kernelspace, and instead directly references the memory,
which can cause problems if invalid data is passed from userspace.  Fix
this all up by correctly copying the memory before accessing it within
the kernel.

Reported-by: Tianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Cc: Steve Glendinning <steve.glendinning@shawell.net>
Cc: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Helge Deller <deller@gmx.de>
This commit is contained in:
Greg Kroah-Hartman 2025-12-28 14:17:03 +01:00 committed by Helge Deller
parent 0209e21e3c
commit 120adae7b4
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/video/fbdev/smscufx.c
View File

@ -932,7 +932,6 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd,
unsigned long arg)
{
struct ufx_data *dev = info->par;
struct dloarea *area = NULL;
if (!atomic_read(&dev->usb_active))
return 0;
@ -947,6 +946,10 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd,
/* TODO: Help propose a standard fb.h ioctl to report mmap damage */
if (cmd == UFX_IOCTL_REPORT_DAMAGE) {
struct dloarea *area __free(kfree) = kmalloc(sizeof(*area), GFP_KERNEL);
if (!area)
return -ENOMEM;
/* If we have a damage-aware client, turn fb_defio "off"
* To avoid perf imact of unnecessary page fault handling.
* Done by resetting the delay for this fb_info to a very
@ -956,7 +959,8 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd,
if (info->fbdefio)
info->fbdefio->delay = UFX_DEFIO_WRITE_DISABLE;
area = (struct dloarea *)arg;
if (copy_from_user(area, (u8 __user *)arg, sizeof(*area)))
return -EFAULT;
if (area->x < 0)
area->x = 0;