All of lore.kernel.org
 help / color / mirror / Atom feed
* [Intel-gfx] [PATCH] drm/i915/gt: Validation rotated vma bounds are within the object
@ 2020-01-09 14:11 Chris Wilson
  2020-01-09 14:52 ` Ville Syrjälä
                   ` (6 more replies)
  0 siblings, 7 replies; 11+ messages in thread
From: Chris Wilson @ 2020-01-09 14:11 UTC (permalink / raw)
  To: intel-gfx

Quite understandably, we bug out when asked to find a page that doesn't
belong to the object. However, we should report the error back to the
user long before we attempt the out-of-bound access! In this case, it is
insufficient validation on the rotated vma, with the simplest/cheapest
point for us to insert a bound check when we are computing the rotated
page lookups.

Similarly, it might be wise to see if we can validate the user input
upon creating the rotated framebuffer.

Closes: https://gitlab.freedesktop.org/drm/intel/issues/951
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Matthew Auld <matthew.auld@intel.com
---
 drivers/gpu/drm/i915/gt/intel_ggtt.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt.c b/drivers/gpu/drm/i915/gt/intel_ggtt.c
index 99189cdba8a9..59a60968a6da 100644
--- a/drivers/gpu/drm/i915/gt/intel_ggtt.c
+++ b/drivers/gpu/drm/i915/gt/intel_ggtt.c
@@ -1283,6 +1283,7 @@ static noinline struct sg_table *
 intel_rotate_pages(struct intel_rotation_info *rot_info,
 		   struct drm_i915_gem_object *obj)
 {
+	const unsigned long npages = obj->base.size >> PAGE_SHIFT;
 	unsigned int size = intel_rotation_info_size(rot_info);
 	struct sg_table *st;
 	struct scatterlist *sg;
@@ -1302,9 +1303,23 @@ intel_rotate_pages(struct intel_rotation_info *rot_info,
 	sg = st->sgl;
 
 	for (i = 0 ; i < ARRAY_SIZE(rot_info->plane); i++) {
-		sg = rotate_pages(obj, rot_info->plane[i].offset,
-				  rot_info->plane[i].width, rot_info->plane[i].height,
-				  rot_info->plane[i].stride, st, sg);
+		const struct intel_remapped_plane_info *plane =
+			&rot_info->plane[i];
+		unsigned long last;
+
+		last = plane->offset;
+		last += (plane->height - 1) * plane->stride;
+		last += plane->width - 1;
+		if (last >= npages) {
+			ret = -EINVAL;
+			goto err_sg_alloc;
+		}
+
+		sg = rotate_pages(obj,
+				  plane->offset,
+				  plane->width, plane->height,
+				  plane->stride,
+				  st, sg);
 	}
 
 	return st;
-- 
2.25.0.rc2

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply related	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2020-01-14 14:41 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-01-09 14:11 [Intel-gfx] [PATCH] drm/i915/gt: Validation rotated vma bounds are within the object Chris Wilson
2020-01-09 14:52 ` Ville Syrjälä
2020-01-09 18:37   ` Ville Syrjälä
2020-01-09 19:01     ` Ville Syrjälä
2020-01-09 23:28 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for " Patchwork
2020-01-09 23:53 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork
2020-01-10 15:53 ` [Intel-gfx] [PATCH v2] drm/i915/gt: Validate " Chris Wilson
2020-01-10 15:57   ` Chris Wilson
2020-01-10 20:21 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gt: Validation rotated vma bounds are within the object (rev2) Patchwork
2020-01-10 20:51 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
2020-01-14 14:41 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.