Commit 120adae7 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Helge Deller
Browse files

fbdev: smscufx: properly copy ioctl memory to kernelspace 



The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from
userspace to kernelspace, and instead directly references the memory,
which can cause problems if invalid data is passed from userspace.  Fix
this all up by correctly copying the memory before accessing it within
the kernel.

Reported-by: default avatarTianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Cc: Steve Glendinning <steve.glendinning@shawell.net>
Cc: Helge Deller <deller@gmx.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
parent 0209e21e

drivers/video/fbdev/smscufx.c

+6 −2
Original line number Diff line number Diff line
@@ -932,7 +932,6 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd, 
			 unsigned long arg)

{

	struct ufx_data *dev = info->par;

	struct dloarea *area = NULL;



	if (!atomic_read(&dev->usb_active))

		return 0;
@@ -947,6 +946,10 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd, 


	/* TODO: Help propose a standard fb.h ioctl to report mmap damage */

	if (cmd == UFX_IOCTL_REPORT_DAMAGE) {

		struct dloarea *area __free(kfree) = kmalloc(sizeof(*area), GFP_KERNEL);

		if (!area)

			return -ENOMEM;



		/* If we have a damage-aware client, turn fb_defio "off"

		 * To avoid perf imact of unnecessary page fault handling.

		 * Done by resetting the delay for this fb_info to a very
@@ -956,7 +959,8 @@ static int ufx_ops_ioctl(struct fb_info *info, unsigned int cmd, 
		if (info->fbdefio)

			info->fbdefio->delay = UFX_DEFIO_WRITE_DISABLE;



		area = (struct dloarea *)arg;

		if (copy_from_user(area, (u8 __user *)arg, sizeof(*area)))

			return -EFAULT;



		if (area->x < 0)

			area->x = 0;