[PATCH] drm: never write to the userspace more data than the callerwants

[Pavel Roskin]

The amount of data wanted by the userspace caller is encoded in the
ioctl number.  Generic drm ioctls were ignoring it.

As a result, Intel Xorg driver didn't work for i386 userspace on x86_64
kernel on some systems.  sizeof(struct drm_mode_get_connector) is 76
bytes on i686 and 80 bytes on x86_64 due to the tail alignment (the data
positions match).  The userspace was using the 4 bytes after the
structure to hold the result of the ioctl.  Since drm_ioctl() was
copying 80 bytes instead of 76, it was clobbering that data.

A workaround has been committed to xf86-video-intel.

Signed-off-by: Pavel Roskin <proski@xxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
 drivers/gpu/drm/drm_drv.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index e572dd2..8a1c721 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -403,8 +403,11 @@ long drm_ioctl(struct file *filp,
 	}
 	else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
 		ioctl = &drm_ioctls[nr];
+		usize = _IOC_SIZE(cmd);
 		cmd = ioctl->cmd;
-		usize = asize = _IOC_SIZE(cmd);
+		asize = _IOC_SIZE(cmd);
+		if (unlikely(usize > asize))
+			usize = asize;
 	} else
 		goto err_i1;
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/