github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-24 15:12:13 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Fix three regressions

Browse Source 
. Fix a regression where vidi_connection_ioctl() used the wrong device
   to look up the vidi context. It stores the vidi device in exynos_drm_private
   and uses it in ioctl(), preventing invalid pointer access and related bugs.
 . Fix a security regression where vidi_connection_ioctl() directly dereferenced
   a user pointer for EDID data. It copies EDID from user space
   with copy_from_user() into kernel memory before use, preventing arbitrary
   kernel memory access.
 . Fix a concurrency regression where vidi_context members related
   to EDID memory were accessed without locking. It protects alloc/free and
   state updates with ctx->lock, preventing race conditions and use-after-free bugs.
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEoxi+6c5pRPV/gdXcxWAb7Og/+bYFAml/ZLIACgkQxWAb7Og/
 +bYH9wv+LS7gitzT+qqGXORSV08Eu3bu/vtC/nDpDk/UdVix8/8wCpOYm3SlCdbZ
 Q6VJl/0l3+3W351DK/nc+f1SS03Z4oIEo0x/xpJaZfcrPfYUMuyiFR291iXk+MSi
 qF+1id/4PhtpkWviAQ1g/+KxVIpzvRDDnaBccbjUn7weIBCoTvuEXj1JcsdujHo7
 Qwg1KJ47kgFnrhGKvKzTJDPgGjrhaTiCYrDPpLRKTp0FqfDTPH76fyJdEW0q1C2L
 cSaiDtZBFyzKrsOdDzFYlYm5B1/ERxawsh4TXwvUFyTMsMVTFegi8ODA4FbJJTlp
 sflMu3AyWjCDfdtoMrGpiZoRal0lvcXqIWztZTwpvYS5VO8D8W6fSRQEYA+Dmwi1
 QCPGYeijnU6D6NdkbbH0vp2s03rgMS9MSHy6YRAHI0QLa3awI54usJ1b+DKmlYFg
 cieEvaFL17vsL2yQ4GCAKc9u7HYDJolYIWHX62O0bN0wDP30eVT71qWcnGe/c2Sh
 LPRgqL0z
 =xWsw
 -----END PGP SIGNATURE-----

Merge tag 'exynos-drm-next-for-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next

Fix three regressions
. Fix a regression where vidi_connection_ioctl() used the wrong device
  to look up the vidi context. It stores the vidi device in exynos_drm_private
  and uses it in ioctl(), preventing invalid pointer access and related bugs.
. Fix a security regression where vidi_connection_ioctl() directly dereferenced
  a user pointer for EDID data. It copies EDID from user space
  with copy_from_user() into kernel memory before use, preventing arbitrary
  kernel memory access.
. Fix a concurrency regression where vidi_context members related
  to EDID memory were accessed without locking. It protects alloc/free and
  state updates with ctx->lock, preventing race conditions and use-after-free bugs.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Inki Dae <inki.dae@samsung.com>
Link: https://patch.msgid.link/20260201143939.27074-1-inki.dae@samsung.com
This commit is contained in:
Dave Airlie 2026-02-02 11:17:06 +10:00
commit 3cc9398a9e
2 changed files with 64 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/gpu/drm/exynos/exynos_drm_drv.h
View File

@ -199,6 +199,7 @@ struct drm_exynos_file_private {
struct exynos_drm_private {
struct device *g2d_dev;
struct device *dma_dev;
struct device *vidi_dev;
void *mapping;
/* for atomic commit */

74
drivers/gpu/drm/exynos/exynos_drm_vidi.c
View File

@ -187,29 +187,37 @@ static ssize_t vidi_store_connection(struct device *dev,
const char *buf, size_t len)
{
struct vidi_context *ctx = dev_get_drvdata(dev);
int ret;
int ret, new_connected;
ret = kstrtoint(buf, 0, &ctx->connected);
ret = kstrtoint(buf, 0, &new_connected);
if (ret)
return ret;
if (ctx->connected > 1)
if (new_connected > 1)
return -EINVAL;
mutex_lock(&ctx->lock);
/*
* Use fake edid data for test. If raw_edid is set then it can't be
* tested.
*/
if (ctx->raw_edid) {
DRM_DEV_DEBUG_KMS(dev, "edid data is not fake data.\n");
return -EINVAL;
ret = -EINVAL;
goto fail;
}
ctx->connected = new_connected;
mutex_unlock(&ctx->lock);
DRM_DEV_DEBUG_KMS(dev, "requested connection.\n");
drm_helper_hpd_irq_event(ctx->drm_dev);
return len;
fail:
mutex_unlock(&ctx->lock);
return ret;
}
static DEVICE_ATTR(connection, 0644, vidi_show_connection,
@ -224,9 +232,14 @@ ATTRIBUTE_GROUPS(vidi);
int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
struct drm_file *file_priv)
{
struct vidi_context *ctx = dev_get_drvdata(drm_dev->dev);
struct exynos_drm_private *priv = drm_dev->dev_private;
struct device *dev = priv ? priv->vidi_dev : NULL;
struct vidi_context *ctx = dev ? dev_get_drvdata(dev) : NULL;
struct drm_exynos_vidi_connection *vidi = data;
if (!ctx)
return -ENODEV;
if (!vidi) {
DRM_DEV_DEBUG_KMS(ctx->dev,
"user data for vidi is null.\n");
@ -239,21 +252,38 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
return -EINVAL;
}
mutex_lock(&ctx->lock);
if (ctx->connected == vidi->connection) {
mutex_unlock(&ctx->lock);
DRM_DEV_DEBUG_KMS(ctx->dev,
"same connection request.\n");
return -EINVAL;
}
mutex_unlock(&ctx->lock);
if (vidi->connection) {
const struct drm_edid *drm_edid;
const struct edid *raw_edid;
const void __user *edid_userptr = u64_to_user_ptr(vidi->edid);
void *edid_buf;
struct edid hdr;
size_t size;
raw_edid = (const struct edid *)(unsigned long)vidi->edid;
size = (raw_edid->extensions + 1) * EDID_LENGTH;
if (copy_from_user(&hdr, edid_userptr, sizeof(hdr)))
return -EFAULT;
drm_edid = drm_edid_alloc(raw_edid, size);
size = (hdr.extensions + 1) * EDID_LENGTH;
edid_buf = kmalloc(size, GFP_KERNEL);
if (!edid_buf)
return -ENOMEM;
if (copy_from_user(edid_buf, edid_userptr, size)) {
kfree(edid_buf);
return -EFAULT;
}
drm_edid = drm_edid_alloc(edid_buf, size);
kfree(edid_buf);
if (!drm_edid)
return -ENOMEM;
@ -263,14 +293,21 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
"edid data is invalid.\n");
return -EINVAL;
}
mutex_lock(&ctx->lock);
ctx->raw_edid = drm_edid;
mutex_unlock(&ctx->lock);
} else {
/* with connection = 0, free raw_edid */
mutex_lock(&ctx->lock);
drm_edid_free(ctx->raw_edid);
ctx->raw_edid = NULL;
mutex_unlock(&ctx->lock);
}
mutex_lock(&ctx->lock);
ctx->connected = vidi->connection;
mutex_unlock(&ctx->lock);
drm_helper_hpd_irq_event(ctx->drm_dev);
return 0;
@ -285,7 +322,7 @@ static enum drm_connector_status vidi_detect(struct drm_connector *connector,
* connection request would come from user side
* to do hotplug through specific ioctl.
*/
return ctx->connected ? connector_status_connected :
return READ_ONCE(ctx->connected) ? connector_status_connected :
connector_status_disconnected;
}
@ -308,11 +345,15 @@ static int vidi_get_modes(struct drm_connector *connector)
const struct drm_edid *drm_edid;
int count;
mutex_lock(&ctx->lock);
if (ctx->raw_edid)
drm_edid = drm_edid_dup(ctx->raw_edid);
else
drm_edid = drm_edid_alloc(fake_edid_info, sizeof(fake_edid_info));
mutex_unlock(&ctx->lock);
drm_edid_connector_update(connector, drm_edid);
count = drm_edid_connector_add_modes(connector);
@ -372,6 +413,7 @@ static int vidi_bind(struct device *dev, struct device *master, void *data)
{
struct vidi_context *ctx = dev_get_drvdata(dev);
struct drm_device *drm_dev = data;
struct exynos_drm_private *priv = drm_dev->dev_private;
struct drm_encoder *encoder = &ctx->encoder;
struct exynos_drm_plane *exynos_plane;
struct exynos_drm_plane_config plane_config = { 0 };
@ -379,6 +421,8 @@ static int vidi_bind(struct device *dev, struct device *master, void *data)
int ret;
ctx->drm_dev = drm_dev;
if (priv)
priv->vidi_dev = dev;
plane_config.pixel_formats = formats;
plane_config.num_pixel_formats = ARRAY_SIZE(formats);
@ -424,8 +468,12 @@ static int vidi_bind(struct device *dev, struct device *master, void *data)
static void vidi_unbind(struct device *dev, struct device *master, void *data)
{
struct vidi_context *ctx = dev_get_drvdata(dev);
struct drm_device *drm_dev = data;
struct exynos_drm_private *priv = drm_dev->dev_private;
timer_delete_sync(&ctx->timer);
if (priv)
priv->vidi_dev = NULL;
}
static const struct component_ops vidi_component_ops = {
@ -457,9 +505,13 @@ static void vidi_remove(struct platform_device *pdev)
{
struct vidi_context *ctx = platform_get_drvdata(pdev);
mutex_lock(&ctx->lock);
drm_edid_free(ctx->raw_edid);
ctx->raw_edid = NULL;
mutex_unlock(&ctx->lock);
component_del(&pdev->dev, &vidi_component_ops);
}