From patchwork Fri May 12 19:02:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9724833 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4A5B5600CB for ; Fri, 12 May 2017 19:35:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3FE812888A for ; Fri, 12 May 2017 19:35:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 34CD72888D; Fri, 12 May 2017 19:35:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id C3CEC2888A for ; Fri, 12 May 2017 19:35:13 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 6E71A6E727; Fri, 12 May 2017 19:34:38 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-lf0-x243.google.com (mail-lf0-x243.google.com [IPv6:2a00:1450:4010:c07::243]) by gabe.freedesktop.org (Postfix) with ESMTPS id 640696E1EA for ; Fri, 12 May 2017 19:02:30 +0000 (UTC) Received: by mail-lf0-x243.google.com with SMTP id h4so824471lfj.3 for ; Fri, 12 May 2017 12:02:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=OZj8OXjUj+S0OCXuzc6S2rLzk0Ahng+heIgOZw0dB/E=; b=gPXqBoDEysDQWWqxqzZ1kiJJkNMKCI4O22DwDRRgnn0gjH/ycikK031IYS3Z+CzykW IqcUNZYURStZKSlwikuM0EFCHQ+4znL5BO6ADG+hpTxh0jZS9kRZxAt5/LnHnTL0wbFR ct4OxvW+AYpJ9kYen6YC9hyoQFTJ9fl5eXz+jIPfEm8sa5H65tHrmrhH9KvgRFmSZNeR 58dy2scjYuEhGLvEDPO/LYv5hNnckhbKQ6LeAthT3HJBuZi8/+X8zfbVw3OorB9QB7A7 vqdMCNlqT6LoviY9xj3CSMdIKmPynCQPKPiWRf4JRTjg/OqD+hqQbsaegTxxbgHWEZ3A 7RJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=OZj8OXjUj+S0OCXuzc6S2rLzk0Ahng+heIgOZw0dB/E=; b=GAQZP7gN1B4GFUcNyKGWGHcQEw+tLLJic9zgUUJp+SylfXUtuFZmfqRtrUvTKNY1iM SBJ3ejjcDk2kMU2ceM5u8vvY+FNxjFbDxX27QNWZposaf4wOQ8FjN4yTs7F3w7BCRMIB Qz+eDT9PU9wRo7id+OCkr7YLtObKXX9TvGjsiw2jeYW0En7QIwNuzSRY1FvYd3VRGWTK 9lfuQrhPff7uqvh3gfU5QZNVv2u30bl8poOkfqG3HWxdnNY6QROBm8j9q9KJ/wjGH6xN 5S7/wwt2d04NeGpeb01YpxmiuYJ1vNkH6CHbHix1ZsR33WrKoKiNzQZNXA1ui60q8WGz X3cw== X-Gm-Message-State: AODbwcA48i9sDEYVP0tqiPuYb80QUjInUlpeYqGLjrQ9mUaN8YYRaN9H qKy0LPgpyWH3DA== X-Received: by 10.46.15.18 with SMTP id 18mr1743115ljp.64.1494615748847; Fri, 12 May 2017 12:02:28 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-175.pppoe.spdop.ru. [109.252.91.175]) by smtp.gmail.com with ESMTPSA id z6sm714921lfj.33.2017.05.12.12.02.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 12 May 2017 12:02:28 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding Subject: [PATCH 3/3] drm/tegra: Check size of a submitted command buffer Date: Fri, 12 May 2017 22:02:12 +0300 Message-Id: <20170512190212.17798-1-digetx@gmail.com> X-Mailer: git-send-email 2.12.2 X-Mailman-Approved-At: Fri, 12 May 2017 19:34:31 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP If command buffer claims a number of words that is higher than its BO can fit and a relocation lays past the BO, a kernel OOPS will be fired on that relocation address patching. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. [ 46.829393] Unable to handle kernel paging request at virtual address f09b2000 ... [] (host1x_job_pin) from [] (tegra_drm_submit+0x474/0x510) [] (tegra_drm_submit) from [] (tegra_submit+0x50/0x6c) [] (tegra_submit) from [] (drm_ioctl+0x1e4/0x3ec) [] (drm_ioctl) from [] (do_vfs_ioctl+0x9c/0x8e4) [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c) [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) Signed-off-by: Dmitry Osipenko --- drivers/gpu/drm/tegra/drm.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index 732c8d98044f..e9c74a7780e7 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c @@ -361,20 +361,30 @@ int tegra_drm_submit(struct tegra_drm_context *context, while (num_cmdbufs) { struct drm_tegra_cmdbuf cmdbuf; - struct host1x_bo *bo; + struct drm_gem_object *gem; + struct tegra_bo *bo; if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) { err = -EFAULT; goto fail; } - bo = host1x_bo_lookup(file, cmdbuf.handle); - if (!bo) { + gem = drm_gem_object_lookup(file, cmdbuf.handle); + if (!gem) { err = -ENOENT; goto fail; } - host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset); + drm_gem_object_unreference_unlocked(gem); + + if (cmdbuf.words * 4 > gem->size) { + err = -EINVAL; + goto fail; + } + + bo = to_tegra_bo(gem); + host1x_job_add_gather(job, &bo->base, + cmdbuf.words, cmdbuf.offset); num_cmdbufs--; cmdbufs++; }