Commit 4ecc24a8 authored by Tvrtko Ursulin's avatar Tvrtko Ursulin Committed by Thomas Zimmermann

drm/v3d: Validate passed in drm syncobj handles in the performance extension

If userspace provides an unknown or invalid handle anywhere in the handle
array the rest of the driver will not handle that well.

Fix it by checking handle was looked up successfully or otherwise fail the
extension by jumping into the existing unwind.
Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@igalia.com>
Fixes: bae7cb5d ("drm/v3d: Create a CPU job extension for the reset performance query job")
Cc: Maíra Canal <mcanal@igalia.com>
Cc: Iago Toral Quiroga <itoral@igalia.com>
Cc: stable@vger.kernel.org # v6.8+
Reviewed-by: default avatarMaíra Canal <mcanal@igalia.com>
Signed-off-by: default avatarMaíra Canal <mcanal@igalia.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-6-tursulin@igalia.com
(cherry picked from commit a546b7e4)
Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
parent 023d22e8
......@@ -710,6 +710,10 @@ v3d_get_cpu_reset_performance_params(struct drm_file *file_priv,
}
job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
if (!job->performance_query.queries[i].syncobj) {
err = -ENOENT;
goto error;
}
}
job->performance_query.count = reset.count;
job->performance_query.nperfmons = reset.nperfmons;
......@@ -790,6 +794,10 @@ v3d_get_cpu_copy_performance_query_params(struct drm_file *file_priv,
}
job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
if (!job->performance_query.queries[i].syncobj) {
err = -ENOENT;
goto error;
}
}
job->performance_query.count = copy.count;
job->performance_query.nperfmons = copy.nperfmons;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment