Fix three regressions

Browse source

. Fix a regression where vidi_connection_ioctl() used the wrong device
   to look up the vidi context. It stores the vidi device in exynos_drm_private
   and uses it in ioctl(), preventing invalid pointer access and related bugs.
 . Fix a security regression where vidi_connection_ioctl() directly dereferenced
   a user pointer for EDID data. It copies EDID from user space
   with copy_from_user() into kernel memory before use, preventing arbitrary
   kernel memory access.
 . Fix a concurrency regression where vidi_context members related
   to EDID memory were accessed without locking. It protects alloc/free and
   state updates with ctx->lock, preventing race conditions and use-after-free bugs.
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEoxi+6c5pRPV/gdXcxWAb7Og/+bYFAml/ZLIACgkQxWAb7Og/
 +bYH9wv+LS7gitzT+qqGXORSV08Eu3bu/vtC/nDpDk/UdVix8/8wCpOYm3SlCdbZ
 Q6VJl/0l3+3W351DK/nc+f1SS03Z4oIEo0x/xpJaZfcrPfYUMuyiFR291iXk+MSi
 qF+1id/4PhtpkWviAQ1g/+KxVIpzvRDDnaBccbjUn7weIBCoTvuEXj1JcsdujHo7
 Qwg1KJ47kgFnrhGKvKzTJDPgGjrhaTiCYrDPpLRKTp0FqfDTPH76fyJdEW0q1C2L
 cSaiDtZBFyzKrsOdDzFYlYm5B1/ERxawsh4TXwvUFyTMsMVTFegi8ODA4FbJJTlp
 sflMu3AyWjCDfdtoMrGpiZoRal0lvcXqIWztZTwpvYS5VO8D8W6fSRQEYA+Dmwi1
 QCPGYeijnU6D6NdkbbH0vp2s03rgMS9MSHy6YRAHI0QLa3awI54usJ1b+DKmlYFg
 cieEvaFL17vsL2yQ4GCAKc9u7HYDJolYIWHX62O0bN0wDP30eVT71qWcnGe/c2Sh
 LPRgqL0z
 =xWsw
 -----END PGP SIGNATURE-----

Merge tag 'exynos-drm-next-for-v6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next

Fix three regressions
. Fix a regression where vidi_connection_ioctl() used the wrong device
  to look up the vidi context. It stores the vidi device in exynos_drm_private
  and uses it in ioctl(), preventing invalid pointer access and related bugs.
. Fix a security regression where vidi_connection_ioctl() directly dereferenced
  a user pointer for EDID data. It copies EDID from user space
  with copy_from_user() into kernel memory before use, preventing arbitrary
  kernel memory access.
. Fix a concurrency regression where vidi_context members related
  to EDID memory were accessed without locking. It protects alloc/free and
  state updates with ctx->lock, preventing race conditions and use-after-free bugs.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Inki Dae <inki.dae@samsung.com>
Link: https://patch.msgid.link/20260201143939.27074-1-inki.dae@samsung.com

...

This commit is contained in:

Dave Airlie 2026-02-02 11:17:06 +10:00

parent a60f627cf4 52b330799e

commit 3cc9398a9e

2 changed files with 64 additions and 11 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

drivers/gpu/drm/exynos/exynos_drm_drv.h

View file

74

drivers/gpu/drm/exynos/exynos_drm_vidi.c

View file