evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: kgsl: Correct memory type update in IOCTL_KGSL_GPUOBJ_SET_INFO

Browse source 
A bad user can pass memory type parameter value greater than 255.
Limit the memory type value to valid range before updating memory
descriptor flags to avoid incorrect flag update.

Change-Id: I23ce69584d1e2c9969583461ee942c5046e7cdbc
Signed-off-by: Deepak Kumar <dkumar@codeaurora.org>
This commit is contained in:
Deepak Kumar 2018-02-23 16:31:46 +05:30 • committed by Gerrit - the friendly Code Review server
parent 94cda67dae
commit d567b416ed
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/gpu/msm/kgsl.c
View file

@ -3977,6 +3977,7 @@ long kgsl_ioctl_gpuobj_set_info(struct kgsl_device_private *dev_priv,
struct kgsl_process_private *private = dev_priv->process_priv; struct kgsl_process_private *private = dev_priv->process_priv;
struct kgsl_gpuobj_set_info *param = data; struct kgsl_gpuobj_set_info *param = data;
struct kgsl_mem_entry *entry; struct kgsl_mem_entry *entry;
int ret = 0;
if (param->id == 0) if (param->id == 0)
return -EINVAL; return -EINVAL;
@ -3989,12 +3990,16 @@ long kgsl_ioctl_gpuobj_set_info(struct kgsl_device_private *dev_priv,
copy_metadata(entry, param->metadata, param->metadata_len); copy_metadata(entry, param->metadata, param->metadata_len);
if (param->flags & KGSL_GPUOBJ_SET_INFO_TYPE) { if (param->flags & KGSL_GPUOBJ_SET_INFO_TYPE) {
if (param->type <= (KGSL_MEMTYPE_MASK >> KGSL_MEMTYPE_SHIFT)) {
entry->memdesc.flags &= ~((uint64_t) KGSL_MEMTYPE_MASK); entry->memdesc.flags &= ~((uint64_t) KGSL_MEMTYPE_MASK);
entry->memdesc.flags |= param->type << KGSL_MEMTYPE_SHIFT; entry->memdesc.flags |= (uint64_t)((param->type <<
KGSL_MEMTYPE_SHIFT) & KGSL_MEMTYPE_MASK);
} else
ret = -EINVAL;
} }
kgsl_mem_entry_put(entry); kgsl_mem_entry_put(entry);
return 0; return ret;
} }
long kgsl_ioctl_cff_syncmem(struct kgsl_device_private *dev_priv, long kgsl_ioctl_cff_syncmem(struct kgsl_device_private *dev_priv,