Commit f37d63e2 authored by Philipp Stanner's avatar Philipp Stanner Committed by Dave Airlie
Browse files

drm_lease.c: copy user-array safely 



Currently, there is no overflow-check with memdup_user().

Use the new function memdup_array_user() instead of memdup_user() for
duplicating the user-space array safely.

Suggested-by: default avatarDavid Airlie <airlied@redhat.com>
Signed-off-by: default avatarPhilipp Stanner <pstanner@redhat.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarZack Rusin <zackr@vmware.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230920123612.16914-6-pstanner@redhat.com
parent ca077657

drivers/gpu/drm/drm_lease.c

+2 −2
Original line number Diff line number Diff line
@@ -510,8 +510,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev, 
	/* Handle leased objects, if any */

	idr_init(&leases);

	if (object_count != 0) {

		object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),

					 array_size(object_count, sizeof(__u32)));

		object_ids = memdup_array_user(u64_to_user_ptr(cl->object_ids),

					       object_count, sizeof(__u32));

		if (IS_ERR(object_ids)) {

			ret = PTR_ERR(object_ids);

			idr_destroy(&leases);