From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mikko Perttunen Subject: Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations Date: Tue, 16 May 2017 09:56:04 +0300 Message-ID: <3db57134-4dba-e886-059c-96034192f637@kapsi.fi> References: <20170514204734.22130-1-digetx@gmail.com> <20170514204734.22130-3-digetx@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20170514204734.22130-3-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> Sender: linux-tegra-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Dmitry Osipenko , Thierry Reding Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, DRI Development , Erik Faye-Lund List-Id: linux-tegra@vger.kernel.org On 14.05.2017 23:47, Dmitry Osipenko wrote: > If commands buffer claims a number of words that is higher than its BO can > fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was > triggered by an opentegra Xorg driver that erroneously pushed too many > commands to the pushbuf. The CMDA commands buffer address is 4 bytes > aligned, so check the alignment as well. > > Add a sanity check for the relocations in a same way. > > [ 46.829393] Unable to handle kernel paging request at virtual address f09b2000 > ... > [] (host1x_job_pin) from [] (tegra_drm_submit+0x474/0x510) > [] (tegra_drm_submit) from [] (tegra_submit+0x50/0x6c) > [] (tegra_submit) from [] (drm_ioctl+0x1e4/0x3ec) > [] (drm_ioctl) from [] (do_vfs_ioctl+0x9c/0x8e4) > [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c) > [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) > > Signed-off-by: Dmitry Osipenko > Reviewed-by: Erik Faye-Lund > --- > drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++ > drivers/gpu/drm/tegra/gem.c | 5 ----- > drivers/gpu/drm/tegra/gem.h | 5 +++++ > 3 files changed, 35 insertions(+), 5 deletions(-) > > diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c > index 768750226452..c5844a065681 100644 > --- a/drivers/gpu/drm/tegra/drm.c > +++ b/drivers/gpu/drm/tegra/drm.c > @@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context *context, > while (num_cmdbufs) { > struct drm_tegra_cmdbuf cmdbuf; > struct host1x_bo *bo; > + struct tegra_bo *obj; > + u64 offset; > > if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) { > err = -EFAULT; > @@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context *context, > goto fail; > } > > + offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32); > + obj = host1x_to_tegra_bo(bo); > + > + if (offset & 3 || offset > obj->gem.size) { > + err = -EINVAL; > + goto fail; > + } > + > host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset); > num_cmdbufs--; > cmdbufs++; > @@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context *context, > > /* copy and resolve relocations from submit */ > while (num_relocs--) { > + struct host1x_reloc *reloc; > + struct tegra_bo *obj; > + > err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs], > &relocs[num_relocs], drm, > file); > if (err < 0) > goto fail; > + > + reloc = &job->relocarray[num_relocs]; > + obj = host1x_to_tegra_bo(reloc->cmdbuf.bo); > + > + if (reloc->cmdbuf.offset & 3 || > + reloc->cmdbuf.offset > obj->gem.size) { This could still fail if the bo's size is not divisible by 4, even with >= comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the same as in the gather case, i.e. find out the address immediately after the write and compare using >. Perhaps add a helper function if it makes sense. I also don't think the "& 3" checks are needed. > + err = -EINVAL; > + goto fail; > + } > + > + obj = host1x_to_tegra_bo(reloc->target.bo); > + > + if (reloc->target.offset & 3 || > + reloc->target.offset > obj->gem.size) { > + err = -EINVAL; > + goto fail; > + } > } > > if (copy_from_user(job->waitchk, waitchks, > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index b76d7ac75696..a0ff30c01ac1 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -20,11 +20,6 @@ > #include "drm.h" > #include "gem.h" > > -static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo) > -{ > - return container_of(bo, struct tegra_bo, base); > -} > - > static void tegra_bo_put(struct host1x_bo *bo) > { > struct tegra_bo *obj = host1x_to_tegra_bo(bo); > diff --git a/drivers/gpu/drm/tegra/gem.h b/drivers/gpu/drm/tegra/gem.h > index 6c5f12ac0087..8b32a6fd586d 100644 > --- a/drivers/gpu/drm/tegra/gem.h > +++ b/drivers/gpu/drm/tegra/gem.h > @@ -52,6 +52,11 @@ static inline struct tegra_bo *to_tegra_bo(struct drm_gem_object *gem) > return container_of(gem, struct tegra_bo, gem); > } > > +static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo) > +{ > + return container_of(bo, struct tegra_bo, base); > +} > + > struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size, > unsigned long flags); > struct tegra_bo *tegra_bo_create_with_handle(struct drm_file *file, >