Closed GustavoARSilva closed 6 months ago
Replace one-element array with flexible-array member in vmwgfx_so.c:
struct vmw_view { struct rcu_head rcu; struct vmw_resource res; struct vmw_resource *ctx; /* Immutable */ struct vmw_resource *srf; /* Immutable */ struct vmw_resource *cotable; /* Immutable */ struct list_head srf_head; /* Protected by binding_mutex */ struct list_head cotable_head; /* Protected by binding_mutex */ unsigned view_type; /* Immutable */ unsigned view_id; /* Immutable */ u32 cmd_size; /* Immutable */ bool committed; /* Protected by binding_mutex */ u32 cmd[1]; /* Immutable */ };
Audit (at least) all these places where the fake flex array is being used:
diff -u -p ./drivers/gpu/drm/vmwgfx/vmwgfx_so.c /tmp/nothing/drivers/gpu/drm/vmwgfx/vmwgfx_so.c --- ./drivers/gpu/drm/vmwgfx/vmwgfx_so.c +++ /tmp/nothing/drivers/gpu/drm/vmwgfx/vmwgfx_so.c @@ -177,7 +177,6 @@ static int vmw_view_create(struct vmw_re return -ENOMEM; } - memcpy(cmd, &view->cmd, view->cmd_size); WARN_ON(cmd->body.view_id != view->view_id); /* Sid may have changed due to surface eviction. */ WARN_ON(view->srf->id == SVGA3D_INVALID_ID); @@ -356,7 +355,6 @@ int vmw_view_add(struct vmw_cmdbuf_res_m view->committed = false; INIT_LIST_HEAD(&view->srf_head); INIT_LIST_HEAD(&view->cotable_head); - memcpy(&view->cmd, cmd, cmd_size); ret = vmw_resource_init(dev_priv, res, true, vmw_view_res_free, &vmw_view_func); if (ret)
Fixed in commit edfea16a6dae9c03bdc97babdd69960093263354.
Replace one-element array with flexible-array member in vmwgfx_so.c:
Audit (at least) all these places where the fake flex array is being used: