KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
80 stars 5 forks source link

Replace one-element array with flex-array member in drivers/gpu/drm/vmwgfx/vmwgfx_so.c #254

Closed GustavoARSilva closed 1 year ago

GustavoARSilva commented 1 year ago
drivers/gpu/drm/vmwgfx/vmwgfx_so.c:
 61 struct vmw_view {
 62         struct rcu_head rcu;
 63         struct vmw_resource res;
 64         struct vmw_resource *ctx;      /* Immutable */
 65         struct vmw_resource *srf;      /* Immutable */
 66         struct vmw_resource *cotable;  /* Immutable */
 67         struct list_head srf_head;     /* Protected by binding_mutex */
 68         struct list_head cotable_head; /* Protected by binding_mutex */
 69         unsigned view_type;            /* Immutable */
 70         unsigned view_id;              /* Immutable */
 71         u32 cmd_size;                  /* Immutable */
 72         bool committed;                /* Protected by binding_mutex */
 73         u32 cmd[1];                     /* Immutable */
 74 };

Also, worth noting is that this fake flex-array is currently being used as argument in calls to memcpy():

drivers/gpu/drm/vmwgfx/vmwgfx_so.c:
memcpy(cmd, &view->cmd, view->cmd_size);
memcpy(&view->cmd, cmd, cmd_size);