Commit a546b7e4 authored by Tvrtko Ursulin's avatar Tvrtko Ursulin Committed by Maíra Canal

drm/v3d: Validate passed in drm syncobj handles in the performance extension

If userspace provides an unknown or invalid handle anywhere in the handle
array the rest of the driver will not handle that well.

Fix it by checking handle was looked up successfully or otherwise fail the
extension by jumping into the existing unwind.
Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@igalia.com>
Fixes: bae7cb5d ("drm/v3d: Create a CPU job extension for the reset performance query job")
Cc: Maíra Canal <mcanal@igalia.com>
Cc: Iago Toral Quiroga <itoral@igalia.com>
Cc: stable@vger.kernel.org # v6.8+
Reviewed-by: default avatarMaíra Canal <mcanal@igalia.com>
Signed-off-by: default avatarMaíra Canal <mcanal@igalia.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-6-tursulin@igalia.com
parent 8d1276d1
...@@ -710,6 +710,10 @@ v3d_get_cpu_reset_performance_params(struct drm_file *file_priv, ...@@ -710,6 +710,10 @@ v3d_get_cpu_reset_performance_params(struct drm_file *file_priv,
} }
job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync); job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
if (!job->performance_query.queries[i].syncobj) {
err = -ENOENT;
goto error;
}
} }
job->performance_query.count = reset.count; job->performance_query.count = reset.count;
job->performance_query.nperfmons = reset.nperfmons; job->performance_query.nperfmons = reset.nperfmons;
...@@ -790,6 +794,10 @@ v3d_get_cpu_copy_performance_query_params(struct drm_file *file_priv, ...@@ -790,6 +794,10 @@ v3d_get_cpu_copy_performance_query_params(struct drm_file *file_priv,
} }
job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync); job->performance_query.queries[i].syncobj = drm_syncobj_find(file_priv, sync);
if (!job->performance_query.queries[i].syncobj) {
err = -ENOENT;
goto error;
}
} }
job->performance_query.count = copy.count; job->performance_query.count = copy.count;
job->performance_query.nperfmons = copy.nperfmons; job->performance_query.nperfmons = copy.nperfmons;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment