drm/i915/userptr: add user_size limit check (24860ad7) · Commits · 戴 / test

Don't allow a mismatch between obj->base.size/vma->size and the actual number of pages for the backing store, which is limited to INT_MAX pages. v2: document what are missing before we can safely drop the limit check Signed-off-by:

Matthew Auld <matthew.auld@intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by:

Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by:

Chris Wilson <chris@chris-wilson.co.uk> Link: https://patchwork.freedesktop.org/patch/msgid/20200117132413.1170563-1-matthew.auld@intel.com

drivers/gpu/drm/i915/gem/i915_gem_userptr.c

+17 −0

Original line number	Diff line number	Diff line
		@@ -769,6 +769,23 @@ i915_gem_userptr_ioctl(struct drm_device *dev,
		I915_USERPTR_UNSYNCHRONIZED))
		return -EINVAL;

		/*
		* XXX: There is a prevalence of the assumption that we fit the
		* object's page count inside a 32bit _signed_ variable. Let's document
		* this and catch if we ever need to fix it. In the meantime, if you do
		* spot such a local variable, please consider fixing!
		*
		* Aside from our own locals (for which we have no excuse!):
		* - sg_table embeds unsigned int for num_pages
		* - get_user_pages*() mixed ints with longs
		*/

		if (args->user_size >> PAGE_SHIFT > INT_MAX)
		return -E2BIG;

		if (overflows_type(args->user_size, obj->base.size))
		return -E2BIG;

		if (!args->user_size)
		return -EINVAL;

Admin message