From patchwork Sun May 14 20:47:32 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9725935 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9BA9460381 for ; Mon, 15 May 2017 00:48:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8E81F2891E for ; Mon, 15 May 2017 00:48:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 833F228935; Mon, 15 May 2017 00:48:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3320F2891E for ; Mon, 15 May 2017 00:48:45 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 21A5E89DB8; Mon, 15 May 2017 00:48:35 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wr0-x243.google.com (mail-wr0-x243.google.com [IPv6:2a00:1450:400c:c0c::243]) by gabe.freedesktop.org (Postfix) with ESMTPS id 9ADBA6E032 for ; Sun, 14 May 2017 20:48:53 +0000 (UTC) Received: by mail-wr0-x243.google.com with SMTP id g12so12703248wrg.2 for ; Sun, 14 May 2017 13:48:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=zsMlPpfQ0gbvdwIQAiWOSjr1tEnwk7F0uNowJZyZjk4=; b=hS+mNAVB74Gw/J5OKsKU8fyLreV4vQ298WZKnezIxfM31eVqnqlIhXHlDzdN0KVCKk xpUbxoOer3VFIjGt5YBFL40ANHXc1+WBbId4qCtBCFDP5fYF6J0pBQwLuRyOkw3C51Ve XrCm/A2XFw8i9b4jUUIBOBXsOltPYLAOu7vBlkcT741XCUKMmf5oPUBnGx55JAqtsoMV UUp64kU8VbiNzc6YcGb965d6c4PwzMNPoCAFSaDw6hZzQw89P2rc7cyWPmCVrxN+pNZz quFkzZMUDgrvZ6kMdUkCsbtxL1YPDWuTJj4koDjUOuZqX3N7wrkWzLItFfuY1k7zzVFC LzOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=zsMlPpfQ0gbvdwIQAiWOSjr1tEnwk7F0uNowJZyZjk4=; b=dftUvSgy7iWSV3HpsT9ZSRjKQKU+gcEASqA7T3Z9c2O8WLKW21ZSphTKy3PDLqssMC x9lUpWJvj/54UiRllOu8DWQVJlUzu+ZE/aupVQHsXu0FkckvRvhoYGbk3MquOoppdinY zmKkOb6Ig8rnbTt8ISt69WWcJhnet5duaGI+C2J/3TksgU5sEdsc0KRkEGvSuo51hy0P aN+iy+zf5Pmb1hMJ5dRqoTXTBCG/66vvamoqXy6CU2ozAvL2kEykYEO3VqRenwetiJbW 67OkK/6aSA6xrz+Ljdip4Tz2anbT3JlH/L9fyYCoP1Wa4hEz/11nF1u2JZs6fnA2nQv9 DMxw== X-Gm-Message-State: AODbwcC5w/ifVdYrj1BbsGYBQ8PRnttq8Rrgd8rGoPzJMhJj0CS1IAGE qAteTYVeRg67Gubvr68= X-Received: by 10.46.77.91 with SMTP id a88mr1166232ljb.1.1494794932255; Sun, 14 May 2017 13:48:52 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-175.pppoe.spdop.ru. [109.252.91.175]) by smtp.gmail.com with ESMTPSA id 75sm1839959lja.53.2017.05.14.13.48.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 14 May 2017 13:48:51 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding , Mikko Perttunen Subject: [PATCH] drm/tegra: Check whether page belongs to BO in tegra_bo_kmap() Date: Sun, 14 May 2017 23:47:32 +0300 Message-Id: <20170514204734.22130-2-digetx@gmail.com> X-Mailer: git-send-email 2.13.0 In-Reply-To: <20170514204734.22130-1-digetx@gmail.com> References: <20170514204734.22130-1-digetx@gmail.com> X-Mailman-Approved-At: Mon, 15 May 2017 00:48:34 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP This fixes an OOPS in case of out-of-bounds accessing of a kmap'ed commands buffer CMA while patching relocations in do_relocs(). Signed-off-by: Dmitry Osipenko --- drivers/gpu/drm/tegra/gem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c index 424569b53e57..b76d7ac75696 100644 --- a/drivers/gpu/drm/tegra/gem.c +++ b/drivers/gpu/drm/tegra/gem.c @@ -74,6 +74,9 @@ static void *tegra_bo_kmap(struct host1x_bo *bo, unsigned int page) { struct tegra_bo *obj = host1x_to_tegra_bo(bo); + if (page * PAGE_SIZE > obj->gem.size) + return NULL; + if (obj->vaddr) return obj->vaddr + page * PAGE_SIZE; else if (obj->gem.import_attach)