From patchwork Fri May 12 19:29:03 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9724829 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6F7B0600CB for ; Fri, 12 May 2017 19:34:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 657CE2888A for ; Fri, 12 May 2017 19:34:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5A6332888D; Fri, 12 May 2017 19:34:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4F6B32888A for ; Fri, 12 May 2017 19:34:48 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 934B16E712; Fri, 12 May 2017 19:34:32 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-lf0-x243.google.com (mail-lf0-x243.google.com [IPv6:2a00:1450:4010:c07::243]) by gabe.freedesktop.org (Postfix) with ESMTPS id AE92C6E705 for ; Fri, 12 May 2017 19:29:53 +0000 (UTC) Received: by mail-lf0-x243.google.com with SMTP id 99so873038lfu.2 for ; Fri, 12 May 2017 12:29:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=dszAHT/526ZvYDu7iE/C7o37mvDU+RZmBRvd7JSLYT4=; b=ZVzSKtMYO5O05CXLSPxXfDJJZh3web0SJasep3Y+B4xapB6W9ygKNo3B8X1dWodKfg 1NI31UcGZaJ+gZ1z46y5SMECaK4thEkyd8Rt/A2nts4OU7g8yOiGYYNmf+p6yJibegyi AW4apJ2X8oA+cinBx63FhRo14cF7kT1dvVJb3g82RNFVrOAa8S4IU7NCbiqJfr/TvTY1 MN516uvjTjV0QXPObYcrEVCZmyF1S0t3lEJetXkkAUk514r3cQ+TzykwtXfpn1wUeWlj kcYgnEqUQXMXBC5KlnmiyGeWY9W0DtsKTpL60IHg9WNr61LFRDJq17d7CXza0ShcUXbL CgpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=dszAHT/526ZvYDu7iE/C7o37mvDU+RZmBRvd7JSLYT4=; b=k0TAUl8j5cG9TBptAHl4DkO/9Ff6RyOTWGBLlHhMCLVnGuVXdcmbnSJLmvp6kmgMmq +DfREI7A3Lq8Aia0qOgE9+du0xDjrQ86QiOZrakK0If0WdFXYGpUcCtE3CKjJxV7c5ms gfFEGjOhaMLGvXvcYyB3nOGulWB2YCqcyR7sWjpJg94hNNKGAn/XlNmuvLazQ5V0Jfw8 BctiFpjmMD6w9CF5o5HJbN3YKABUifP4mrBmsQfExdPNcVkjM+qXcgzWfY3CGLoYtvvI A5DO+eT5cCAyb1H4ElVWaf2r+P8XRjzE7mzSnZ4gXo5BeTFUGg+Z4n+ftUlOV1+yWTYY +e6A== X-Gm-Message-State: AODbwcBhnbbW6hb+gK/vtkDFjysjSVaVoD1uVEJmhTu7ZYNMXfnriIss PDw1W3n9h6CR0A== X-Received: by 10.46.81.89 with SMTP id b25mr1790447lje.16.1494617392133; Fri, 12 May 2017 12:29:52 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-175.pppoe.spdop.ru. [109.252.91.175]) by smtp.gmail.com with ESMTPSA id 25sm710537ljp.58.2017.05.12.12.29.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 12 May 2017 12:29:51 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding , Erik Faye-Lund Subject: [PATCH v2] drm/tegra: Check size of a submitted command buffer Date: Fri, 12 May 2017 22:29:03 +0300 Message-Id: <20170512192903.25491-1-digetx@gmail.com> X-Mailer: git-send-email 2.12.2 X-Mailman-Approved-At: Fri, 12 May 2017 19:34:31 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP If command buffer claims a number of words that is higher than its BO can fit and a relocation lays past the BO, a kernel OOPS will be fired on that relocation address patching. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. [ 46.829393] Unable to handle kernel paging request at virtual address f09b2000 ... [] (host1x_job_pin) from [] (tegra_drm_submit+0x474/0x510) [] (tegra_drm_submit) from [] (tegra_submit+0x50/0x6c) [] (tegra_submit) from [] (drm_ioctl+0x1e4/0x3ec) [] (drm_ioctl) from [] (do_vfs_ioctl+0x9c/0x8e4) [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c) [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) Signed-off-by: Dmitry Osipenko Reviewed-by: Erik Faye-Lund --- v2: Take into account the cmdbuf.offset drivers/gpu/drm/tegra/drm.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index 732c8d98044f..9ad4ac7c08d1 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c @@ -361,20 +361,30 @@ int tegra_drm_submit(struct tegra_drm_context *context, while (num_cmdbufs) { struct drm_tegra_cmdbuf cmdbuf; - struct host1x_bo *bo; + struct drm_gem_object *gem; + struct tegra_bo *bo; if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) { err = -EFAULT; goto fail; } - bo = host1x_bo_lookup(file, cmdbuf.handle); - if (!bo) { + gem = drm_gem_object_lookup(file, cmdbuf.handle); + if (!gem) { err = -ENOENT; goto fail; } - host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset); + drm_gem_object_unreference_unlocked(gem); + + if (cmdbuf.offset + cmdbuf.words * 4 > gem->size) { + err = -EINVAL; + goto fail; + } + + bo = to_tegra_bo(gem); + host1x_job_add_gather(job, &bo->base, + cmdbuf.words, cmdbuf.offset); num_cmdbufs--; cmdbufs++; }