github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

drm/msm: Fix missing VM_BIND offset/range validation

Browse Source 
We need to reject the MAP op if offset+range is larger than the BO size.

Reported-by: Connor Abbott <cwabbott0@gmail.com>
Fixes: 2e6a8a1fe2 ("drm/msm: Add VM_BIND ioctl")
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Tested-by: Connor Abbott <cwabbott0@gmail.com>
Patchwork: https://patchwork.freedesktop.org/patch/669781/
This commit is contained in:
Rob Clark 2025-08-20 17:04:26 -07:00
parent 278f890443
commit 3a3bef68a6
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/gpu/drm/msm/msm_gem_vma.c
View File

@ -1080,6 +1080,12 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
op->obj = obj;
cnt++;
if ((op->range + op->obj_offset) > obj->size) {
ret = UERR(EINVAL, dev, "invalid range: %016llx + %016llx > %016zx\n",
op->range, op->obj_offset, obj->size);
goto out_unlock;
}
}
*nr_bos = cnt;