iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/virtio: fix OOB in virtio_gpu_object_create

Browse Source 
After commit f651c8b055 ("drm/virtio: factor out the sg_table from
virtio_gpu_object"), virtio_gpu_create_object allocates too small space
to fit everything in. It is because it allocates struct
virtio_gpu_object, but should allocate a newly added struct
virtio_gpu_object_shmem which has 2 more members.

So fix that by using correct type in virtio_gpu_create_object.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: http://patchwork.freedesktop.org/patch/msgid/20200319100421.16267-1-jslaby@suse.cz
Fixes: f651c8b055 ("drm/virtio: factor out the sg_table from virtio_gpu_object")
Cc: Gurchetan Singh <gurchetansingh@chromium.org>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 0666a8d7f6)
This commit is contained in:
Jiri Slaby 2020-03-19 11:04:21 +01:00 committed by Gerd Hoffmann
parent c0f83d164f
commit b513b0d456
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/gpu/drm/virtio/virtgpu_object.c
View File

@ -123,15 +123,17 @@ bool virtio_gpu_is_shmem(struct virtio_gpu_object *bo)
struct drm_gem_object *virtio_gpu_create_object(struct drm_device *dev,
size_t size)
{
struct virtio_gpu_object *bo;
struct virtio_gpu_object_shmem *shmem;
struct drm_gem_shmem_object *dshmem;
bo = kzalloc(sizeof(*bo), GFP_KERNEL);
if (!bo)
shmem = kzalloc(sizeof(*shmem), GFP_KERNEL);
if (!shmem)
return NULL;
bo->base.base.funcs = &virtio_gpu_shmem_funcs;
bo->base.map_cached = true;
return &bo->base.base;
dshmem = &shmem->base.base;
dshmem->base.funcs = &virtio_gpu_shmem_funcs;
dshmem->map_cached = true;
return &dshmem->base;
}
static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,