From 1539fb9bd405ee32282ea0a38404f9e008ac5b7a Mon Sep 17 00:00:00 2001 From: Zhaowei Yuan Date: Wed, 18 Jun 2014 14:33:59 +0800 Subject: drm: fix NULL pointer access by wrong ioctl If user uses wrong ioctl command with _IOC_NONE and argument size greater than 0, it can cause NULL pointer access from memset of line 463. If _IOC_NONE, don't memset to 0 for kdata. Signed-off-by: Zhaowei Yuan Reviewed-by: David Herrmann Cc: Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) mode change 100644 => 100755 drivers/gpu/drm/drm_drv.c (limited to 'drivers/gpu/drm/drm_drv.c') diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c old mode 100644 new mode 100755 index 03711d00aaae..8218078b6133 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -419,8 +419,9 @@ long drm_ioctl(struct file *filp, retcode = -EFAULT; goto err_i1; } - } else + } else if (cmd & IOC_OUT) { memset(kdata, 0, usize); + } if (ioctl->flags & DRM_UNLOCKED) retcode = func(dev, kdata, file_priv); -- cgit v1.2.3 From 186026874cdb57e91cdd080150162f0380348824 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Thu, 3 Jul 2014 07:54:26 +1000 Subject: drm: fix permissions on drm_drv.c 1539fb9bd405ee32282ea0a38404f9e008ac5b7a managed to somehow +x drm_drv.c undo it. Signed-off-by: Dave Airlie --- drivers/gpu/drm/drm_drv.c | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 drivers/gpu/drm/drm_drv.c (limited to 'drivers/gpu/drm/drm_drv.c') diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c old mode 100755 new mode 100644 -- cgit v1.2.3