OSDN Git Service

drm/virtio: fix OOB in virtio_gpu_object_create
authorJiri Slaby <jslaby@suse.cz>
Thu, 19 Mar 2020 10:04:21 +0000 (11:04 +0100)
committerGerd Hoffmann <kraxel@redhat.com>
Mon, 6 Apr 2020 13:10:37 +0000 (15:10 +0200)
commitb513b0d4563ab70a0a25e7a0ed94afaf88ac28bf
treedc4570f0bc89df6b7e057411acb99c8240cfc957
parentc0f83d164fb8f3a2b7bc379a6c1e27d1123a9eab
drm/virtio: fix OOB in virtio_gpu_object_create

After commit f651c8b05542 ("drm/virtio: factor out the sg_table from
virtio_gpu_object"), virtio_gpu_create_object allocates too small space
to fit everything in. It is because it allocates struct
virtio_gpu_object, but should allocate a newly added struct
virtio_gpu_object_shmem which has 2 more members.

So fix that by using correct type in virtio_gpu_create_object.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: http://patchwork.freedesktop.org/patch/msgid/20200319100421.16267-1-jslaby@suse.cz
Fixes: f651c8b05542 ("drm/virtio: factor out the sg_table from virtio_gpu_object")
Cc: Gurchetan Singh <gurchetansingh@chromium.org>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 0666a8d7f6a4530440e59f2d22ed4091f4d3818c)
drivers/gpu/drm/virtio/virtgpu_object.c