From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 782742E7631 for ; Mon, 15 Jun 2026 21:46:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781559978; cv=none; b=XWwVZoBHMEAcCLNBUFGuQBVLIzV70mIpurvGEKL9JtlV7HSK+bV95g8rl2m0FA+TFpR77SaCDNUyxIGqY7vkJOfMRsRnEP8jW/aLSpj6DYXq9cQO3xix8m3NOShGudXSW7K9SB4XP7KaC2Yn4bCdsAYDkteF8kIFnZyTOkqEgK8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781559978; c=relaxed/simple; bh=1IdWJSsooHpRWnlvtfAwsDPz6wI8yPfuVVKZnegPiWY=; h=From:To:Cc:Subject:Date:Message-ID:Content-Type:MIME-Version; b=oNMQQkXQ/A+NrcHI2ltTu1v13ePpbDnk9PvmTAipHSApb1a9CRHYswF1ruI9Th9pGa/KwPuVIkslDTPuhEDWlwLEy9oVuk/0ZYq46BKiMJIfZWrCJYOgbwA++gZqZhS5YXVyMmnQhjUo7sDwD/xQsDua+/aI/xUst3q/fth5gCU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ip0ZPIf2; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ip0ZPIf2" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-c8584bbbf2cso2260758a12.3 for ; Mon, 15 Jun 2026 14:46:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781559977; x=1782164777; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=vz6stOMSk3vpFUFzv+jJpjA2EoqJIkxHHZXo5ER0nFI=; b=Ip0ZPIf2AZFGF3enB/dktdH89h+aGD2o2cgbJ8SPk3O0Mw80gTZekiJl6Qslhg2NMv BkY+xIx8Rw6CPI1J+xIIIa/zBqduSbmX0s4bO33eZdaXc4pzC0JKPu0bRvfkyJSzlGKt f0I5RX9gfEvGcMKqb82PTtqr8T5eL1HVrqSnTEr/uEslmSb2rd65GEzS2NIyq1q1CpzB BXx1KaCIW5nBt/1HZMOfVPMK6p5uTG0Yw1fn73/hjOtfYg/A8cvKhq9SKbiYTic1BYg6 0Y6yqgLLqDgoLN/1rj4VGvQrAmKesyCXqKkwH2JmdMRYEs5KZKDUHoJF5x3RelwWbYpe raXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781559977; x=1782164777; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=vz6stOMSk3vpFUFzv+jJpjA2EoqJIkxHHZXo5ER0nFI=; b=tCA80/bsoGu1tatrFA9CxAcsuLzIhtO5Vj7fCkoATH3RFENhAJHTildCuUdEELydL8 gzRbozkdb+3WF1xmnVwe4Y12XEbhrWpiCpb1eX4Qz2qifV8f/mh7ftJNkcTHBOiL6qcu r5rbdO4HyXXI4sg9+WMl51CwoYqnBY6MQaxbmMJ8b7T5eVD8nkkZmm4xjC140DdC5vP/ bGZ+DVAC8pxQKYd5/DasSDvqUB29flqooQmScMPpb8eA/We3lo41a2NhxrojExpHRI/F M/VhwfPEGhROlajNAD3gHmOvR2ou81KpcrYL6IWTmuqVH6okycbNZW42cPZ/clFM6rpf enoQ== X-Forwarded-Encrypted: i=1; AFNElJ/E8M1Htm0DuJQicKTMaDQjYpkQ8UFT6Mj33dijM/FYD1b/3tTL9f2PFMfNE4hGYldQg++fsVhRs0HCd38=@vger.kernel.org X-Gm-Message-State: AOJu0YzoT7lJMQ4lFSr4vIc4UnIPm1uZY4C2kyef2wX6rE3SK4VAVi3N 11Q1ORqfvYGRp7BnCgvQxz17P7L+FBkeydDreJXhTMmTFUwkbMrE0XqT8iYFWxbnDnXGLA== X-Gm-Gg: Acq92OFPZrg9j0Ult0VUeOzVm3a0JWZ0/MQuw4oeLv3V/7VU8fMOX5V943fyGZ2kQNL F3g9ynTTshZbXM/TtnlO2FjyLBkOTjf565vSOMcOsI0fPWsy8A+nFLOkc4wTLkjSQTx8JTGHGZ6 IMbnYneO/98AFHlgaiohme92Wpo6PBL6P3Ts0N+MeU6uM5CwNseH5/357kH52Wl0TSxja12Ogtk 6N3y7QJRY+7PmLrp/SwPIR06ecwHyoTnRTGBGwMVKKcMcCgAG0qivisL4xTs1kRseh/mBX3vzqW k1QbAAnEZMg8rICFK6DvyyXm4qo+vS/nfRg8Fic1gTG+/rR/i6rMgV5ODHOVpLlKO+2umdnVMm8 mn36M6p5lmdwCRLFsPBCYTFIcdtZmRLGWaaFlLsOYMHdXW0SAxYrZxYcuubIsAc0f6dvigt3sM1 M0VvbyKH1oBHfv1/g79JFoozqAhHXBeG61kDhPawdJwrxmoo/TGGISXxugb+KlXYrjzYG4DKWB6 9kWjKAAzj0rG1Erw8Q250v4gm+zIQ== X-Received: by 2002:a05:6a20:748a:b0:3b4:7aae:1ee8 with SMTP id adf61e73a8af0-3b79624cb18mr14017944637.14.1781559976818; Mon, 15 Jun 2026 14:46:16 -0700 (PDT) Received: from 1.0.0.127.in-addr.arpa ([103.129.135.168]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c8661b5e509sm9835799a12.3.2026.06.15.14.46.12 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 15 Jun 2026 14:46:16 -0700 (PDT) From: shuvampandey1@gmail.com To: Frank Binns , Matt Coster Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Donald Robson , Sarah Walker , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] drm/imagination: Fix user array stride in pvr_set_uobj_array() Date: Tue, 16 Jun 2026 03:31:09 +0545 Message-ID: <178155996993.4848.8618351576278880213@gmail.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 pvr_set_uobj_array() copies an array of kernel objects to a userspace array whose element size is described by out->stride. When out->stride is different from the kernel object size, the slow path advances the userspace pointer by the kernel object size and the kernel pointer by the userspace stride. This reverses the intended layout. For larger userspace strides, later copies read from the wrong kernel addresses. For smaller userspace strides, later copies are written at the wrong userspace offsets. The padding clear is also done only for the first element instead of the padding area for each element. Advance the userspace pointer by out->stride and the kernel pointer by obj_size, and clear per-element padding while the current userspace pointer is still available. Fixes: f99f5f3ea7ef ("drm/imagination: Add GPU ID parsing and firmware loadin= g") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Shuvam Pandey --- drivers/gpu/drm/imagination/pvr_drv.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/imagination/pvr_drv.c b/drivers/gpu/drm/imaginat= ion/pvr_drv.c index 268900464ab6..0a68a9c32361 100644 --- a/drivers/gpu/drm/imagination/pvr_drv.c +++ b/drivers/gpu/drm/imagination/pvr_drv.c @@ -1252,14 +1252,13 @@ pvr_set_uobj_array(const struct drm_pvr_obj_array *ou= t, u32 min_stride, u32 obj_ if (copy_to_user(out_ptr, in_ptr, cpy_elem_size)) return -EFAULT; =20 - out_ptr +=3D obj_size; - in_ptr +=3D out->stride; - } + if (out->stride > obj_size && + clear_user(out_ptr + cpy_elem_size, out->stride - obj_size)) { + return -EFAULT; + } =20 - if (out->stride > obj_size && - clear_user(u64_to_user_ptr(out->array + obj_size), - out->stride - obj_size)) { - return -EFAULT; + out_ptr +=3D out->stride; + in_ptr +=3D obj_size; } } =20