Commit 3cc9398a authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'exynos-drm-next-for-v6.20' of... 

Merge tag 'exynos-drm-next-for-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos

 into drm-next

Fix three regressions
. Fix a regression where vidi_connection_ioctl() used the wrong device
  to look up the vidi context. It stores the vidi device in exynos_drm_private
  and uses it in ioctl(), preventing invalid pointer access and related bugs.
. Fix a security regression where vidi_connection_ioctl() directly dereferenced
  a user pointer for EDID data. It copies EDID from user space
  with copy_from_user() into kernel memory before use, preventing arbitrary
  kernel memory access.
. Fix a concurrency regression where vidi_context members related
  to EDID memory were accessed without locking. It protects alloc/free and
  state updates with ctx->lock, preventing race conditions and use-after-free bugs.

Signed-off-by: default avatarDave Airlie <airlied@redhat.com>

From: Inki Dae <inki.dae@samsung.com>
Link: https://patch.msgid.link/20260201143939.27074-1-inki.dae@samsung.com
parents a60f627c 52b33079

drivers/gpu/drm/exynos/exynos_drm_drv.h

+1 −0
Original line number Diff line number Diff line
@@ -199,6 +199,7 @@ struct drm_exynos_file_private { 
struct exynos_drm_private {

	struct device *g2d_dev;

	struct device *dma_dev;

	struct device *vidi_dev;

	void *mapping;



	/* for atomic commit */

drivers/gpu/drm/exynos/exynos_drm_vidi.c

+63 −11
Original line number Diff line number Diff line
@@ -187,29 +187,37 @@ static ssize_t vidi_store_connection(struct device *dev, 
				const char *buf, size_t len)

{

	struct vidi_context *ctx = dev_get_drvdata(dev);

	int ret;

	int ret, new_connected;



	ret = kstrtoint(buf, 0, &ctx->connected);

	ret = kstrtoint(buf, 0, &new_connected);

	if (ret)

		return ret;



	if (ctx->connected > 1)

	if (new_connected > 1)

		return -EINVAL;



	mutex_lock(&ctx->lock);



	/*

	 * Use fake edid data for test. If raw_edid is set then it can't be

	 * tested.

	 */

	if (ctx->raw_edid) {

		DRM_DEV_DEBUG_KMS(dev, "edid data is not fake data.\n");

		return -EINVAL;

		ret = -EINVAL;

		goto fail;

	}



	ctx->connected = new_connected;

	mutex_unlock(&ctx->lock);



	DRM_DEV_DEBUG_KMS(dev, "requested connection.\n");



	drm_helper_hpd_irq_event(ctx->drm_dev);



	return len;

fail:

	mutex_unlock(&ctx->lock);

	return ret;

}



static DEVICE_ATTR(connection, 0644, vidi_show_connection,
@@ -224,9 +232,14 @@ ATTRIBUTE_GROUPS(vidi); 
int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,

				struct drm_file *file_priv)

{

	struct vidi_context *ctx = dev_get_drvdata(drm_dev->dev);

	struct exynos_drm_private *priv = drm_dev->dev_private;

	struct device *dev = priv ? priv->vidi_dev : NULL;

	struct vidi_context *ctx = dev ? dev_get_drvdata(dev) : NULL;

	struct drm_exynos_vidi_connection *vidi = data;



	if (!ctx)

		return -ENODEV;



	if (!vidi) {

		DRM_DEV_DEBUG_KMS(ctx->dev,

				  "user data for vidi is null.\n");
@@ -239,21 +252,38 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data, 
		return -EINVAL;

	}



	mutex_lock(&ctx->lock);

	if (ctx->connected == vidi->connection) {

		mutex_unlock(&ctx->lock);

		DRM_DEV_DEBUG_KMS(ctx->dev,

				  "same connection request.\n");

		return -EINVAL;

	}

	mutex_unlock(&ctx->lock);



	if (vidi->connection) {

		const struct drm_edid *drm_edid;

		const struct edid *raw_edid;

		const void __user *edid_userptr = u64_to_user_ptr(vidi->edid);

		void *edid_buf;

		struct edid hdr;

		size_t size;



		raw_edid = (const struct edid *)(unsigned long)vidi->edid;

		size = (raw_edid->extensions + 1) * EDID_LENGTH;

		if (copy_from_user(&hdr, edid_userptr, sizeof(hdr)))

			return -EFAULT;



		drm_edid = drm_edid_alloc(raw_edid, size);

		size = (hdr.extensions + 1) * EDID_LENGTH;



		edid_buf = kmalloc(size, GFP_KERNEL);

		if (!edid_buf)

			return -ENOMEM;



		if (copy_from_user(edid_buf, edid_userptr, size)) {

			kfree(edid_buf);

			return -EFAULT;

		}



		drm_edid = drm_edid_alloc(edid_buf, size);

		kfree(edid_buf);

		if (!drm_edid)

			return -ENOMEM;
@@ -263,14 +293,21 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data, 
					  "edid data is invalid.\n");

			return -EINVAL;

		}

		mutex_lock(&ctx->lock);

		ctx->raw_edid = drm_edid;

		mutex_unlock(&ctx->lock);

	} else {

		/* with connection = 0, free raw_edid */

		mutex_lock(&ctx->lock);

		drm_edid_free(ctx->raw_edid);

		ctx->raw_edid = NULL;

		mutex_unlock(&ctx->lock);

	}



	mutex_lock(&ctx->lock);

	ctx->connected = vidi->connection;

	mutex_unlock(&ctx->lock);



	drm_helper_hpd_irq_event(ctx->drm_dev);



	return 0;
@@ -285,7 +322,7 @@ static enum drm_connector_status vidi_detect(struct drm_connector *connector, 
	 * connection request would come from user side

	 * to do hotplug through specific ioctl.

	 */

	return ctx->connected ? connector_status_connected :

	return READ_ONCE(ctx->connected) ? connector_status_connected :

			connector_status_disconnected;

}
@@ -308,11 +345,15 @@ static int vidi_get_modes(struct drm_connector *connector) 
	const struct drm_edid *drm_edid;

	int count;



	mutex_lock(&ctx->lock);



	if (ctx->raw_edid)

		drm_edid = drm_edid_dup(ctx->raw_edid);

	else

		drm_edid = drm_edid_alloc(fake_edid_info, sizeof(fake_edid_info));



	mutex_unlock(&ctx->lock);



	drm_edid_connector_update(connector, drm_edid);



	count = drm_edid_connector_add_modes(connector);
@@ -372,6 +413,7 @@ static int vidi_bind(struct device *dev, struct device *master, void *data) 
{

	struct vidi_context *ctx = dev_get_drvdata(dev);

	struct drm_device *drm_dev = data;

	struct exynos_drm_private *priv = drm_dev->dev_private;

	struct drm_encoder *encoder = &ctx->encoder;

	struct exynos_drm_plane *exynos_plane;

	struct exynos_drm_plane_config plane_config = { 0 };
@@ -379,6 +421,8 @@ static int vidi_bind(struct device *dev, struct device *master, void *data) 
	int ret;



	ctx->drm_dev = drm_dev;

	if (priv)

		priv->vidi_dev = dev;



	plane_config.pixel_formats = formats;

	plane_config.num_pixel_formats = ARRAY_SIZE(formats);
@@ -424,8 +468,12 @@ static int vidi_bind(struct device *dev, struct device *master, void *data) 
static void vidi_unbind(struct device *dev, struct device *master, void *data)

{

	struct vidi_context *ctx = dev_get_drvdata(dev);

	struct drm_device *drm_dev = data;

	struct exynos_drm_private *priv = drm_dev->dev_private;



	timer_delete_sync(&ctx->timer);

	if (priv)

		priv->vidi_dev = NULL;

}



static const struct component_ops vidi_component_ops = {
@@ -457,9 +505,13 @@ static void vidi_remove(struct platform_device *pdev) 
{

	struct vidi_context *ctx = platform_get_drvdata(pdev);



	mutex_lock(&ctx->lock);



	drm_edid_free(ctx->raw_edid);

	ctx->raw_edid = NULL;



	mutex_unlock(&ctx->lock);



	component_del(&pdev->dev, &vidi_component_ops);

}