Skip to content

Commit 4ecc24a

Browse files
Tvrtko Ursulintdz
authored andcommitted
drm/v3d: Validate passed in drm syncobj handles in the performance extension
If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix it by checking handle was looked up successfully or otherwise fail the extension by jumping into the existing unwind. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Fixes: bae7cb5 ("drm/v3d: Create a CPU job extension for the reset performance query job") Cc: Maíra Canal <mcanal@igalia.com> Cc: Iago Toral Quiroga <itoral@igalia.com> Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-6-tursulin@igalia.com (cherry picked from commit a546b7e) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
1 parent 023d22e commit 4ecc24a

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

drivers/gpu/drm/v3d/v3d_submit.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -710,6 +710,10 @@ v3d_get_cpu_reset_performance_params(struct drm_file *file_priv,
710710
}
711711

712712
job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
713+
if (!job->performance_query.queries[i].syncobj) {
714+
err = -ENOENT;
715+
goto error;
716+
}
713717
}
714718
job->performance_query.count = reset.count;
715719
job->performance_query.nperfmons = reset.nperfmons;
@@ -790,6 +794,10 @@ v3d_get_cpu_copy_performance_query_params(struct drm_file *file_priv,
790794
}
791795

792796
job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
797+
if (!job->performance_query.queries[i].syncobj) {
798+
err = -ENOENT;
799+
goto error;
800+
}
793801
}
794802
job->performance_query.count = copy.count;
795803
job->performance_query.nperfmons = copy.nperfmons;

0 commit comments

Comments
 (0)