diff options
| author | Jiri Slaby <jslaby@suse.cz> | 2020-03-19 11:04:21 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2020-04-06 15:10:37 +0200 |
| commit | b513b0d4563ab70a0a25e7a0ed94afaf88ac28bf (patch) | |
| tree | dc4570f0bc89df6b7e057411acb99c8240cfc957 | |
| parent | c0f83d164fb8f3a2b7bc379a6c1e27d1123a9eab (diff) | |
| download | linux-b513b0d4563ab70a0a25e7a0ed94afaf88ac28bf.tar.bz2 | |
drm/virtio: fix OOB in virtio_gpu_object_create
After commit f651c8b05542 ("drm/virtio: factor out the sg_table from
virtio_gpu_object"), virtio_gpu_create_object allocates too small space
to fit everything in. It is because it allocates struct
virtio_gpu_object, but should allocate a newly added struct
virtio_gpu_object_shmem which has 2 more members.
So fix that by using correct type in virtio_gpu_create_object.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: http://patchwork.freedesktop.org/patch/msgid/20200319100421.16267-1-jslaby@suse.cz
Fixes: f651c8b05542 ("drm/virtio: factor out the sg_table from virtio_gpu_object")
Cc: Gurchetan Singh <gurchetansingh@chromium.org>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 0666a8d7f6a4530440e59f2d22ed4091f4d3818c)
| -rw-r--r-- | drivers/gpu/drm/virtio/virtgpu_object.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 2bfb13d1932e..d9039bb7c5e3 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -123,15 +123,17 @@ bool virtio_gpu_is_shmem(struct virtio_gpu_object *bo) struct drm_gem_object *virtio_gpu_create_object(struct drm_device *dev, size_t size) { - struct virtio_gpu_object *bo; + struct virtio_gpu_object_shmem *shmem; + struct drm_gem_shmem_object *dshmem; - bo = kzalloc(sizeof(*bo), GFP_KERNEL); - if (!bo) + shmem = kzalloc(sizeof(*shmem), GFP_KERNEL); + if (!shmem) return NULL; - bo->base.base.funcs = &virtio_gpu_shmem_funcs; - bo->base.map_cached = true; - return &bo->base.base; + dshmem = &shmem->base.base; + dshmem->base.funcs = &virtio_gpu_shmem_funcs; + dshmem->map_cached = true; + return &dshmem->base; } static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, |