APPLIED: [PATCH][SRU][TRUSTY] Fix drm oops with an unimplemented ioctl

[Khaled Elmously]

On 2018-11-07 15:18:10 , Colin King wrote:
> From: Colin Ian King <colin.king at canonical.com>
> 
> BugLink: https://bugs.launchpad.net/bugs/1797546
> 
> SRU Request [Trusty]
> 
> == Justification ==
> 
> It is possible to cause an oops in drm with an unimplemented ioctl call
> with the following reproducer run as root:
> 
> #include <sys/ioctl.h>
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> 
> int main(void)
> {
> 	int ptnum, fd;
> 
> 	fd = open("/dev/dri/card0", O_RDWR);
> 	return ioctl(fd, TIOCGPTN, &ptnum);
> }
> 
> == Fix ==
> 
> A backport (minor wiggle) of upstream commit 1539fb9bd405
> ("drm: fix NULL pointer access by wrong ioctl").
> 
> == Testing ==
> 
> Run the reproducer above as root, it will trip the oops. With the fix
> this oops won't occur.
> 
> == Regression Potential ==
> 
> Minimal, this is an upstream fix to this exact issue and has been in
> the kernel since 3.16. This only touches the drm ioctl interface.
> 
> Colin Ian King (1):
>   drm: fix NULL pointer access by wrong ioctl
> 
>  drivers/gpu/drm/drm_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> -- 
> 1.9.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team