6754496 [CVE-2008-3831] i915 kernel drm driver uses untrusted offsets

2 files changed, 32 insertions, 49 deletions

diff --git a/usr/src/uts/intel/io/drm/i915_dma.c b/usr/src/uts/intel/io/drm/i915_dma.c
index e9960dd020..ccb7ae0cb7 100644
--- a/usr/src/uts/intel/io/drm/i915_dma.c
+++ b/usr/src/uts/intel/io/drm/i915_dma.c
@@ -944,48 +944,39 @@ void i915_driver_preclose(drm_device_t * dev, drm_file_t *fpriv)
 	}
 }
 
-extern drm_ioctl_desc_t i915_ioctls[];
+drm_ioctl_desc_t i915_ioctls[] = {
+	[DRM_IOCTL_NR(DRM_I915_INIT)] =
+	    {i915_dma_init, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+	[DRM_IOCTL_NR(DRM_I915_FLUSH)] =
+	    {i915_flush_ioctl, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_FLIP)] =
+	    {i915_flip_bufs, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_BATCHBUFFER)] =
+	    {i915_batchbuffer, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_IRQ_EMIT)] =
+	    {i915_irq_emit, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_IRQ_WAIT)] =
+	    {i915_irq_wait, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_GETPARAM)] =
+	    {i915_getparam, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_SETPARAM)] =
+	    {i915_setparam, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+	[DRM_IOCTL_NR(DRM_I915_ALLOC)] =
+	    {i915_mem_alloc, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_FREE)] =
+	    {i915_mem_free, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_INIT_HEAP)] =
+	    {i915_mem_init_heap, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+	[DRM_IOCTL_NR(DRM_I915_CMDBUFFER)] =
+	    {i915_cmdbuffer, DRM_AUTH},
+	[DRM_IOCTL_NR(DRM_I915_DESTROY_HEAP)] =
+	    {i915_mem_destroy_heap, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+	[DRM_IOCTL_NR(DRM_I915_HWS_ADDR)] =
+	    {i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY},
+};
+
+int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
 
-void i915_set_ioctl_desc(int n, drm_ioctl_t * func,
-	    int auth_needed, int root_only, char *desc)
-{
-	i915_ioctls[n].func = func;
-	i915_ioctls[n].auth_needed = auth_needed;
-	i915_ioctls[n].root_only = root_only;
-	i915_ioctls[n].desc = desc;
-}
-void
-i915_init_ioctl_arrays(void)
-{
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_INIT),
-	    i915_dma_init, 1, 1, "i915_dma_init");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_FLUSH),
-	    i915_flush_ioctl, 1, 0, "i915_flush_ioctl");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_FLIP),
-	    i915_flip_bufs, 1, 0, "i915_flip_bufs");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_BATCHBUFFER),
-	    i915_batchbuffer, 1, 0, "i915_batchbuffer");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_IRQ_EMIT),
-	    i915_irq_emit, 1, 0, " i915_irq_emit");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_IRQ_WAIT),
-	    i915_irq_wait, 1, 0, "i915_irq_wait");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_GETPARAM),
-	    i915_getparam, 1, 0, "i915_getparam");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_SETPARAM),
-	    i915_setparam, 1, 1, "i915_setparam");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_ALLOC),
-	    i915_mem_alloc, 1, 0, "i915_mem_alloc");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_FREE),
-	    i915_mem_free, 1, 0, "i915_mem_free");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_INIT_HEAP),
-	    i915_mem_init_heap, 1, 1, "i915_mem_init_heap");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_CMDBUFFER),
-	    i915_cmdbuffer, 1, 0, "i915_cmdbuffer");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_DESTROY_HEAP),
-	    i915_mem_destroy_heap, 1, 1, "i915_mem_destroy_heap");
-	i915_set_ioctl_desc(DRM_IOCTL_NR(DRM_I915_HWS_ADDR),
-	    i915_set_status_page, 1, 0, "i915_set_status_page");
-}
 /**
  * Determine if the device really is AGP or not.
  *
diff --git a/usr/src/uts/intel/io/drm/i915_drv.c b/usr/src/uts/intel/io/drm/i915_drv.c
index 5d0e2cd313..2736423075 100644
--- a/usr/src/uts/intel/io/drm/i915_drv.c
+++ b/usr/src/uts/intel/io/drm/i915_drv.c
@@ -55,8 +55,6 @@
 #include "i915_drv.h"
 #include "drm_pciids.h"
 
-#define	i915_max_ioctl  0x20 /* changed from 15 */
-
 /*
  * copied from vgasubr.h
  */
@@ -91,10 +89,6 @@ static drm_pci_id_list_t i915_pciidlist[] = {
 	i915_PCI_IDS
 };
 
-drm_ioctl_desc_t i915_ioctls[i915_max_ioctl];
-
-extern void i915_init_ioctl_arrays(void);
-
 /*
  * Local routines
  */
@@ -962,8 +956,6 @@ i915_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
 
 static void i915_configure(drm_driver_t *driver)
 {
-	i915_init_ioctl_arrays();
-
 	driver->buf_priv_size	=	1;	/* No dev_priv */
 	driver->load	=	i915_driver_load;
 	driver->unload	=	i915_driver_unload;