mirror of
https://github.com/torvalds/linux.git
synced 2026-09-19 00:58:02 +02:00
2f8b8593c7
v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object
from a userspace-supplied handle but never checks the result. A bogus
or stale handle makes drm_gem_object_lookup() return NULL, which is
then stored in info->indirect and only dereferenced later when the
indirect CSD job runs, turning a userspace mistake into a NULL pointer
dereference in the kernel.
Bail out with -ENOENT as soon as the lookup fails, so the bad handle is
rejected at submission time.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| v3d_bo.c | ||
| v3d_debugfs.c | ||
| v3d_drv.c | ||
| v3d_drv.h | ||
| v3d_fence.c | ||
| v3d_gem.c | ||
| v3d_irq.c | ||
| v3d_mmu.c | ||
| v3d_perfmon.c | ||
| v3d_performance_counters.h | ||
| v3d_power.c | ||
| v3d_regs.h | ||
| v3d_sched.c | ||
| v3d_submit.c | ||
| v3d_sysfs.c | ||
| v3d_trace_points.c | ||
| v3d_trace.h | ||