summaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/virtio
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2020-03-19 11:04:21 +0100
committerGerd Hoffmann <kraxel@redhat.com>2020-03-19 12:00:24 +0100
commit0666a8d7f6a4530440e59f2d22ed4091f4d3818c (patch)
tree90c542c7313c9c8c2a7bb71241509fd0cd970d34 /drivers/gpu/drm/virtio
parentb684822a44469fe44b80aef5cdca52cd979a4ecb (diff)
downloadlinux-0666a8d7f6a4530440e59f2d22ed4091f4d3818c.tar.bz2
drm/virtio: fix OOB in virtio_gpu_object_create
After commit f651c8b05542 ("drm/virtio: factor out the sg_table from virtio_gpu_object"), virtio_gpu_create_object allocates too small space to fit everything in. It is because it allocates struct virtio_gpu_object, but should allocate a newly added struct virtio_gpu_object_shmem which has 2 more members. So fix that by using correct type in virtio_gpu_create_object. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: http://patchwork.freedesktop.org/patch/msgid/20200319100421.16267-1-jslaby@suse.cz Fixes: f651c8b05542 ("drm/virtio: factor out the sg_table from virtio_gpu_object") Cc: Gurchetan Singh <gurchetansingh@chromium.org> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/virtio')
-rw-r--r--drivers/gpu/drm/virtio/virtgpu_object.c14
1 files changed, 8 insertions, 6 deletions
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
index 2bfb13d1932e..d9039bb7c5e3 100644
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -123,15 +123,17 @@ bool virtio_gpu_is_shmem(struct virtio_gpu_object *bo)
struct drm_gem_object *virtio_gpu_create_object(struct drm_device *dev,
size_t size)
{
- struct virtio_gpu_object *bo;
+ struct virtio_gpu_object_shmem *shmem;
+ struct drm_gem_shmem_object *dshmem;
- bo = kzalloc(sizeof(*bo), GFP_KERNEL);
- if (!bo)
+ shmem = kzalloc(sizeof(*shmem), GFP_KERNEL);
+ if (!shmem)
return NULL;
- bo->base.base.funcs = &virtio_gpu_shmem_funcs;
- bo->base.map_cached = true;
- return &bo->base.base;
+ dshmem = &shmem->base.base;
+ dshmem->base.funcs = &virtio_gpu_shmem_funcs;
+ dshmem->map_cached = true;
+ return &dshmem->base;
}
static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,