diff options
author | Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl> | 2019-01-29 20:53:21 -0500 |
---|---|---|
committer | Alex Deucher <alexander.deucher@amd.com> | 2019-02-15 11:15:37 -0500 |
commit | 021830d24ba55a578f602979274965344c8e6284 (patch) | |
tree | 5fe70a4455cea94a2b5b2385bb04cfc523a864d9 /drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | |
parent | 2a84e48e9712ea8591a10dd59d59ccab3d54efd6 (diff) |
drm/amdgpu: Check if fd really is an amdgpu fd.
Otherwise we interpret the file private data as drm & amdgpu data
while it might not be, possibly allowing one to get memory corruption.
Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c')
-rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c index 7f3aa7b7e1d8..637f927e3675 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | |||
@@ -1178,6 +1178,22 @@ static const struct file_operations amdgpu_driver_kms_fops = { | |||
1178 | #endif | 1178 | #endif |
1179 | }; | 1179 | }; |
1180 | 1180 | ||
1181 | int amdgpu_file_to_fpriv(struct file *filp, struct amdgpu_fpriv **fpriv) | ||
1182 | { | ||
1183 | struct drm_file *file; | ||
1184 | |||
1185 | if (!filp) | ||
1186 | return -EINVAL; | ||
1187 | |||
1188 | if (filp->f_op != &amdgpu_driver_kms_fops) { | ||
1189 | return -EINVAL; | ||
1190 | } | ||
1191 | |||
1192 | file = filp->private_data; | ||
1193 | *fpriv = file->driver_priv; | ||
1194 | return 0; | ||
1195 | } | ||
1196 | |||
1181 | static bool | 1197 | static bool |
1182 | amdgpu_get_crtc_scanout_position(struct drm_device *dev, unsigned int pipe, | 1198 | amdgpu_get_crtc_scanout_position(struct drm_device *dev, unsigned int pipe, |
1183 | bool in_vblank_irq, int *vpos, int *hpos, | 1199 | bool in_vblank_irq, int *vpos, int *hpos, |