diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2018-03-14 20:37:31 +0100 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2018-03-14 20:37:31 +0100 |
| commit | b0d8bef8ed805ca92eb91e86acf3ce89cbebc8ce (patch) | |
| tree | 8838391a76f0cf75ffcd31166996d03d19c580a6 /drivers/gpu/drm/virtio/virtgpu_ioctl.c | |
| parent | 82b691bedf05f258f1c86c96ee574b0d7795c0a1 (diff) | |
| parent | fc6eabbbf8ef99efed778dd5afabc83c21dba585 (diff) | |
Merge branch 'linus' into irq/core to pick up dependencies.
Diffstat (limited to 'drivers/gpu/drm/virtio/virtgpu_ioctl.c')
| -rw-r--r-- | drivers/gpu/drm/virtio/virtgpu_ioctl.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c index 5720a0d4ac0a..677ac16c8a6d 100644 --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c @@ -197,6 +197,9 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data, case VIRTGPU_PARAM_3D_FEATURES: value = vgdev->has_virgl_3d == true ? 1 : 0; break; + case VIRTGPU_PARAM_CAPSET_QUERY_FIX: + value = 1; + break; default: return -EINVAL; } @@ -472,7 +475,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, { struct virtio_gpu_device *vgdev = dev->dev_private; struct drm_virtgpu_get_caps *args = data; - int size; + unsigned size, host_caps_size; int i; int found_valid = -1; int ret; @@ -481,6 +484,10 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, if (vgdev->num_capsets == 0) return -ENOSYS; + /* don't allow userspace to pass 0 */ + if (args->size == 0) + return -EINVAL; + spin_lock(&vgdev->display_info_lock); for (i = 0; i < vgdev->num_capsets; i++) { if (vgdev->capsets[i].id == args->cap_set_id) { @@ -496,11 +503,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, return -EINVAL; } - size = vgdev->capsets[found_valid].max_size; - if (args->size > size) { - spin_unlock(&vgdev->display_info_lock); - return -EINVAL; - } + host_caps_size = vgdev->capsets[found_valid].max_size; + /* only copy to user the minimum of the host caps size or the guest caps size */ + size = min(args->size, host_caps_size); list_for_each_entry(cache_ent, &vgdev->cap_cache, head) { if (cache_ent->id == args->cap_set_id && |