diff options
| author | Eric Anholt <anholt@freebsd.org> | 2005-02-08 04:17:14 +0000 |
|---|---|---|
| committer | Eric Anholt <anholt@freebsd.org> | 2005-02-08 04:17:14 +0000 |
| commit | 81459d6e50a02b87ed95073659536eefa1e09fdf (patch) | |
| tree | 92d9d61123ff5f3da299af3cc6a4b7bbd45bcd96 /linux-core | |
| parent | dc4defe742387dc3081557111b67a1ab99455dbb (diff) | |
Close a race which could allow for privilege escalation by users with DRI
privileges on Radeon hardware. Essentially, a malicious program could
submit a packet containing an offset (possibly in main memory) to be
rendered from/to, while a separate thread switched that offset in
userspace rapidly between a valid value and an invalid one.
radeon_check_and_fixup_offset() would pull the offset in from user
space, check it, and spit it back out to user space to be copied in
later by the emit code. It would sometimes catch the bad value, but
sometimes the malicious program could modify it after the check and get
an invalid offset rendered from/to.
Fix this by allocating a temporary buffer and copying the data in at once.
While here, make the cliprects stuff not do the VERIFYAREA_READ and
COPY_FROM_USER_UNCHECKED gymnastics, avoiding a lock order reversal on
FreeBSD. Performance impact is negligible -- no difference on r200 to
~1% improvement on rv200 in quake3 tests (P4 1Ghz, demofour at
1024x768, n=4 or 5).
Diffstat (limited to 'linux-core')
| -rw-r--r-- | linux-core/drm_os_linux.h | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/linux-core/drm_os_linux.h b/linux-core/drm_os_linux.h index fba894f1..0c0bffc0 100644 --- a/linux-core/drm_os_linux.h +++ b/linux-core/drm_os_linux.h @@ -120,8 +120,6 @@ static __inline__ int mtrr_del(int reg, unsigned long base, unsigned long size) __copy_to_user(arg1, arg2, arg3) #define DRM_GET_USER_UNCHECKED(val, uaddr) \ __get_user(val, uaddr) -#define DRM_PUT_USER_UNCHECKED(uaddr, val) \ - __put_user(val, uaddr) #define DRM_GET_PRIV_WITH_RETURN(_priv, _filp) _priv = _filp->private_data |