Unverified Commit d3968a0d authored by Jeongjun Park's avatar Jeongjun Park Committed by Inki Dae
Browse files

drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() 



vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
obtain a struct vidi_context pointer. However, drm_dev->dev is the
exynos-drm master device, and the driver_data contained therein is not
the vidi component device, but a completely different device.

This can lead to various bugs, ranging from null pointer dereferences and
garbage value accesses to, in unlucky cases, out-of-bounds errors,
use-after-free errors, and more.

To resolve this issue, we need to store/delete the vidi device pointer in
exynos_drm_private->vidi_dev during bind/unbind, and then read this
exynos_drm_private->vidi_dev within ioctl() to obtain the correct
struct vidi_context pointer.

Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarJeongjun Park <aha310510@gmail.com>
Signed-off-by: default avatarInki Dae <inki.dae@samsung.com>
parent 502d2d8e

drivers/gpu/drm/exynos/exynos_drm_drv.h

+1 −0
Original line number Diff line number Diff line
@@ -199,6 +199,7 @@ struct drm_exynos_file_private { 
struct exynos_drm_private {

	struct device *g2d_dev;

	struct device *dma_dev;

	struct device *vidi_dev;

	void *mapping;



	/* for atomic commit */

drivers/gpu/drm/exynos/exynos_drm_vidi.c

+13 −1
Original line number Diff line number Diff line
@@ -224,9 +224,14 @@ ATTRIBUTE_GROUPS(vidi); 
int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,

				struct drm_file *file_priv)

{

	struct vidi_context *ctx = dev_get_drvdata(drm_dev->dev);

	struct exynos_drm_private *priv = drm_dev->dev_private;

	struct device *dev = priv ? priv->vidi_dev : NULL;

	struct vidi_context *ctx = dev ? dev_get_drvdata(dev) : NULL;

	struct drm_exynos_vidi_connection *vidi = data;



	if (!ctx)

		return -ENODEV;



	if (!vidi) {

		DRM_DEV_DEBUG_KMS(ctx->dev,

				  "user data for vidi is null.\n");
@@ -372,6 +377,7 @@ static int vidi_bind(struct device *dev, struct device *master, void *data) 
{

	struct vidi_context *ctx = dev_get_drvdata(dev);

	struct drm_device *drm_dev = data;

	struct exynos_drm_private *priv = drm_dev->dev_private;

	struct drm_encoder *encoder = &ctx->encoder;

	struct exynos_drm_plane *exynos_plane;

	struct exynos_drm_plane_config plane_config = { 0 };
@@ -379,6 +385,8 @@ static int vidi_bind(struct device *dev, struct device *master, void *data) 
	int ret;



	ctx->drm_dev = drm_dev;

	if (priv)

		priv->vidi_dev = dev;



	plane_config.pixel_formats = formats;

	plane_config.num_pixel_formats = ARRAY_SIZE(formats);
@@ -424,8 +432,12 @@ static int vidi_bind(struct device *dev, struct device *master, void *data) 
static void vidi_unbind(struct device *dev, struct device *master, void *data)

{

	struct vidi_context *ctx = dev_get_drvdata(dev);

	struct drm_device *drm_dev = data;

	struct exynos_drm_private *priv = drm_dev->dev_private;



	timer_delete_sync(&ctx->timer);

	if (priv)

		priv->vidi_dev = NULL;

}



static const struct component_ops vidi_component_ops = {