KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

Replace 1-element array in drivers/gpu/drm/vmwgfx/vmwgfx_so.c #243

Closed GustavoARSilva closed 6 months ago

GustavoARSilva commented 1 year ago

Replace one-element array with flexible-array member in vmwgfx_so.c:

struct vmw_view {
        struct rcu_head rcu;
        struct vmw_resource res;
        struct vmw_resource *ctx;      /* Immutable */
        struct vmw_resource *srf;      /* Immutable */
        struct vmw_resource *cotable;  /* Immutable */
        struct list_head srf_head;     /* Protected by binding_mutex */
        struct list_head cotable_head; /* Protected by binding_mutex */
        unsigned view_type;            /* Immutable */
        unsigned view_id;              /* Immutable */
        u32 cmd_size;                  /* Immutable */
        bool committed;                /* Protected by binding_mutex */
        u32 cmd[1];                    /* Immutable */
};

Audit (at least) all these places where the fake flex array is being used:

diff -u -p ./drivers/gpu/drm/vmwgfx/vmwgfx_so.c /tmp/nothing/drivers/gpu/drm/vmwgfx/vmwgfx_so.c
--- ./drivers/gpu/drm/vmwgfx/vmwgfx_so.c
+++ /tmp/nothing/drivers/gpu/drm/vmwgfx/vmwgfx_so.c
@@ -177,7 +177,6 @@ static int vmw_view_create(struct vmw_re
                return -ENOMEM;
        }

-       memcpy(cmd, &view->cmd, view->cmd_size);
        WARN_ON(cmd->body.view_id != view->view_id);
        /* Sid may have changed due to surface eviction. */
        WARN_ON(view->srf->id == SVGA3D_INVALID_ID);
@@ -356,7 +355,6 @@ int vmw_view_add(struct vmw_cmdbuf_res_m
        view->committed = false;
        INIT_LIST_HEAD(&view->srf_head);
        INIT_LIST_HEAD(&view->cotable_head);
-       memcpy(&view->cmd, cmd, cmd_size);
        ret = vmw_resource_init(dev_priv, res, true,
                                vmw_view_res_free, &vmw_view_func);
        if (ret)
kees commented 6 months ago

Fixed in commit edfea16a6dae9c03bdc97babdd69960093263354.