diff options
| author | Maíra Canal <mcanal@igalia.com> | 2026-07-03 12:33:35 -0300 |
|---|---|---|
| committer | Maíra Canal <mcanal@igalia.com> | 2026-07-07 18:52:13 -0300 |
| commit | 2f8b8593c7832fad655290cef9e99af05b1b52b3 (patch) | |
| tree | 83831362922a91dee00851e60b583bc1886fcf83 /drivers/gpu/drm | |
| parent | 928caf71e566ddc5f303f15fb9c33f16a9915f30 (diff) | |
| download | linux-2f8b8593c7832fad655290cef9e99af05b1b52b3.tar.gz linux-2f8b8593c7832fad655290cef9e99af05b1b52b3.tar.bz2 linux-2f8b8593c7832fad655290cef9e99af05b1b52b3.zip | |
drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object
from a userspace-supplied handle but never checks the result. A bogus
or stale handle makes drm_gem_object_lookup() return NULL, which is
then stored in info->indirect and only dereferenced later when the
indirect CSD job runs, turning a userspace mistake into a NULL pointer
dereference in the kernel.
Bail out with -ENOENT as soon as the lookup fails, so the bad handle is
rejected at submission time.
Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job")
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-2-bc51b1f3eeb5@igalia.com
Diffstat (limited to 'drivers/gpu/drm')
| -rw-r--r-- | drivers/gpu/drm/v3d/v3d_submit.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c index 1db43c6a078d..7682b24f13ec 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -495,6 +495,8 @@ v3d_get_cpu_indirect_csd_params(struct drm_file *file_priv, sizeof(indirect_csd.wg_uniform_offsets)); info->indirect = drm_gem_object_lookup(file_priv, indirect_csd.indirect); + if (!info->indirect) + return -ENOENT; return v3d_setup_csd_jobs_and_bos(file_priv, v3d, &indirect_csd.submit, &info->job, &info->clean_job, |