Bug 29340 - missing copy_from_user? radeon_info_ioctl
Summary: missing copy_from_user? radeon_info_ioctl
Status: RESOLVED FIXED
Alias: None
Product: DRI
Classification: Unclassified
Component: DRM/Radeon (show other bugs)
Version: unspecified
Hardware: Other Linux (All)
: medium normal
Assignee: Default DRI bug account
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-08-01 06:42 UTC by Dave Gilbert
Modified: 2010-11-18 10:15 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
Kernel patch to add copy from user (874 bytes, patch)
2010-08-01 08:28 UTC, Dave Gilbert
no flags Details | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Dave Gilbert 2010-08-01 06:42:17 UTC
2.6.35 kernel as of git/ubuntu 2.6.35-13.18

In radeon_kms.c there is :


int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
{
        struct radeon_device *rdev = dev->dev_private;
        struct drm_radeon_info *info;
        struct radeon_mode_info *minfo = &rdev->mode_info;
        uint32_t *value_ptr;
        uint32_t value;
        struct drm_crtc *crtc;
        int i, found;

        info = data;
        value_ptr = (uint32_t *)((unsigned long)info->value);
        value = *value_ptr;

I think that *value_ptr should be done with a DRM_COPY_FROM_USER since I'm managing to trigger an oops from it.
(see ubuntu bug 606081)

Dave
Comment 1 Dave Gilbert 2010-08-01 08:28:45 UTC
Created attachment 37502 [details] [review]
Kernel patch to add copy from user

Seems to make Google Earth  5.1.3535.3218 work for me.
Comment 2 Dave Airlie 2010-08-01 16:47:16 UTC
I've queued this fix to Linus, thanks for figuring what was broken.
Comment 3 Alex Deucher 2010-11-18 10:15:33 UTC
upsteam now.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.