Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07678eca authored by Sinclair Yeh's avatar Sinclair Yeh Committed by Thomas Hellstrom
Browse files

drm/vmwgfx: Make sure backup_handle is always valid 



When vmw_gb_surface_define_ioctl() is called with an existing buffer,
we end up returning an uninitialized variable in the backup_handle.

The fix is to first initialize backup_handle to 0 just to be sure, and
second, when a user-provided buffer is found, we will use the
req->buffer_handle as the backup_handle.

Cc: <stable@vger.kernel.org>
Reported-by: default avatarMurray McAllister <murray.mcallister@insomniasec.com>
Signed-off-by: default avatarSinclair Yeh <syeh@vmware.com>
Reviewed-by: default avatarDeepak Rawat <drawat@vmware.com>
parent f0c62e98

drivers/gpu/drm/vmwgfx/vmwgfx_surface.c

+11 −7
Original line number Diff line number Diff line
@@ -1274,7 +1274,7 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, 
	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;

	int ret;

	uint32_t size;

	uint32_t backup_handle;

	uint32_t backup_handle = 0;



	if (req->multisample_count != 0)

		return -EINVAL;
@@ -1317,12 +1317,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, 
		ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,

					     &res->backup,

					     &user_srf->backup_base);

		if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <

		if (ret == 0) {

			if (res->backup->base.num_pages * PAGE_SIZE <

			    res->backup_size) {

				DRM_ERROR("Surface backup buffer is too small.\n");

				vmw_dmabuf_unreference(&res->backup);

				ret = -EINVAL;

				goto out_unlock;

			} else {

				backup_handle = req->buffer_handle;

			}

		}

	} else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)

		ret = vmw_user_dmabuf_alloc(dev_priv, tfile,