]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()
authorTvrtko Ursulin <tvrtko.ursulin@igalia.com>
Fri, 23 Jan 2026 14:15:40 +0000 (14:15 +0000)
committerTvrtko Ursulin <tursulin@ursulin.net>
Mon, 26 Jan 2026 11:45:51 +0000 (11:45 +0000)
commit12f15d52d38ac53f7c70ea3d4b3d76afed04e064
treea627d76f00956d903432ab288ce056645d5106f9
parent0a095b64fa5b4b1edfeb2e9b1751e044230c5d73
drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()

Since GEM bo handles are u32 in the uapi and the internal implementation
uses idr_alloc() which uses int ranges, passing a new handle larger than
INT_MAX trivially triggers a kernel warning:

idr_alloc():
...
if (WARN_ON_ONCE(start < 0))
return -EINVAL;
...

Fix it by rejecting new handles above INT_MAX and at the same time make
the end limit calculation more obvious by moving into int domain.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reported-by: Zhi Wang <wangzhi@stu.xidian.edu.cn>
Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle")
Cc: David Francis <David.Francis@amd.com>
Cc: Felix Kuehling <felix.kuehling@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: <stable@vger.kernel.org> # v6.18+
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260123141540.76540-1-tvrtko.ursulin@igalia.com
drivers/gpu/drm/drm_gem.c