[PATCH] drm/imagination: Fix user array stride in pvr_set_uobj_array()

[PATCH] drm/imagination: Fix user array stride in pvr_set_uobj_array()

[shuvampandey1]

pvr_set_uobj_array() copies an array of kernel objects to a userspace
array whose element size is described by out->stride. When out->stride
is different from the kernel object size, the slow path advances the
userspace pointer by the kernel object size and the kernel pointer by the
userspace stride.

This reverses the intended layout. For larger userspace strides, later
copies read from the wrong kernel addresses. For smaller userspace
strides, later copies are written at the wrong userspace offsets. The
padding clear is also done only for the first element instead of the
padding area for each element.

Advance the userspace pointer by out->stride and the kernel pointer by
obj_size, and clear per-element padding while the current userspace
pointer is still available.

Fixes: f99f5f3ea7ef ("drm/imagination: Add GPU ID parsing and firmware loading")
Cc: stable@vger.kernel.org # v6.8+
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
---
 drivers/gpu/drm/imagination/pvr_drv.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/imagination/pvr_drv.c b/drivers/gpu/drm/imagination/pvr_drv.c
index 268900464ab6..0a68a9c32361 100644
--- a/drivers/gpu/drm/imagination/pvr_drv.c
+++ b/drivers/gpu/drm/imagination/pvr_drv.c
@@ -1252,14 +1252,13 @@ pvr_set_uobj_array(const struct drm_pvr_obj_array *out, u32 min_stride, u32 obj_
 			if (copy_to_user(out_ptr, in_ptr, cpy_elem_size))
 				return -EFAULT;
 
-			out_ptr += obj_size;
-			in_ptr += out->stride;
-		}
+			if (out->stride > obj_size &&
+			    clear_user(out_ptr + cpy_elem_size, out->stride - obj_size)) {
+				return -EFAULT;
+			}
 
-		if (out->stride > obj_size &&
-		    clear_user(u64_to_user_ptr(out->array + obj_size),
-			       out->stride - obj_size)) {
-			return -EFAULT;
+			out_ptr += out->stride;
+			in_ptr += obj_size;
 		}
 	}
 

Re: [PATCH] drm/imagination: Fix user array stride in pvr_set_uobj_array()

[Alessio Belle]

Hi Shuvam,

On Tue, 2026-06-16 at 03:31 +0545, shuvampandey1@gmail.com wrote:
> pvr_set_uobj_array() copies an array of kernel objects to a userspace
> array whose element size is described by out->stride. When out->stride
> is different from the kernel object size, the slow path advances the
> userspace pointer by the kernel object size and the kernel pointer by the
> userspace stride.
> 
> This reverses the intended layout. For larger userspace strides, later
> copies read from the wrong kernel addresses. For smaller userspace
> strides, later copies are written at the wrong userspace offsets. The
> padding clear is also done only for the first element instead of the
> padding area for each element.
> 
> Advance the userspace pointer by out->stride and the kernel pointer by
> obj_size, and clear per-element padding while the current userspace
> pointer is still available.
> 
> Fixes: f99f5f3ea7ef ("drm/imagination: Add GPU ID parsing and firmware loading")
> Cc: stable@vger.kernel.org # v6.8+
> Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>

Could you resend the patch with the "From:" header fixed up with name + email,
to match the signed off line? Somehow the name got lost.

Everything else looks good, so with that sorted,

Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>

Thanks,
Alessio

> ---
>  drivers/gpu/drm/imagination/pvr_drv.c | 13 ++++++-------
>  1 file changed, 6 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/gpu/drm/imagination/pvr_drv.c b/drivers/gpu/drm/imagination/pvr_drv.c
> index 268900464ab6..0a68a9c32361 100644
> --- a/drivers/gpu/drm/imagination/pvr_drv.c
> +++ b/drivers/gpu/drm/imagination/pvr_drv.c
> @@ -1252,14 +1252,13 @@ pvr_set_uobj_array(const struct drm_pvr_obj_array *out, u32 min_stride, u32 obj_
>  			if (copy_to_user(out_ptr, in_ptr, cpy_elem_size))
>  				return -EFAULT;
>  
> -			out_ptr += obj_size;
> -			in_ptr += out->stride;
> -		}
> +			if (out->stride > obj_size &&
> +			    clear_user(out_ptr + cpy_elem_size, out->stride - obj_size)) {
> +				return -EFAULT;
> +			}
>  
> -		if (out->stride > obj_size &&
> -		    clear_user(u64_to_user_ptr(out->array + obj_size),
> -			       out->stride - obj_size)) {
> -			return -EFAULT;
> +			out_ptr += out->stride;
> +			in_ptr += obj_size;
>  		}
>  	}
>