Commit 368f622c authored by Dmitry Osipenko's avatar Dmitry Osipenko Committed by Thierry Reding
Browse files

drm/tegra: Check for malformed offsets and sizes in the 'submit' IOCTL 



If commands buffer claims a number of words that is higher than its BO can
fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was
triggered by an opentegra Xorg driver that erroneously pushed too many
commands to the pushbuf.

The CDMA commands buffer address is 4 bytes aligned, so check its
alignment.

The maximum number of the CDMA gather fetches is 16383, add a check for
it.

Add a sanity check for the relocations in a same way.

[   46.829393] Unable to handle kernel paging request at virtual address f09b2000
...
[<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510)
[<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c)
[<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec)
[<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4)
[<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c)
[<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)

Signed-off-by: default avatarDmitry Osipenko <digetx@gmail.com>
Reviewed-by: default avatarErik Faye-Lund <kusmabite@gmail.com>
Reviewed-by: default avatarMikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: default avatarThierry Reding <treding@nvidia.com>
parent fa6d095e

drivers/gpu/drm/tegra/drm.c

+49 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#define DRIVER_PATCHLEVEL 0



#define CARVEOUT_SZ SZ_64M

#define CDMA_GATHER_FETCHES_MAX_NB 16383



struct tegra_drm_file {

	struct idr contexts;
@@ -383,18 +384,42 @@ int tegra_drm_submit(struct tegra_drm_context *context, 
	while (num_cmdbufs) {

		struct drm_tegra_cmdbuf cmdbuf;

		struct host1x_bo *bo;

		struct tegra_bo *obj;

		u64 offset;



		if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {

			err = -EFAULT;

			goto fail;

		}



		/*

		 * The maximum number of CDMA gather fetches is 16383, a higher

		 * value means the words count is malformed.

		 */

		if (cmdbuf.words > CDMA_GATHER_FETCHES_MAX_NB) {

			err = -EINVAL;

			goto fail;

		}



		bo = host1x_bo_lookup(file, cmdbuf.handle);

		if (!bo) {

			err = -ENOENT;

			goto fail;

		}



		offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32);

		obj = host1x_to_tegra_bo(bo);



		/*

		 * Gather buffer base address must be 4-bytes aligned,

		 * unaligned offset is malformed and cause commands stream

		 * corruption on the buffer address relocation.

		 */

		if (offset & 3 || offset >= obj->gem.size) {

			err = -EINVAL;

			goto fail;

		}



		host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);

		num_cmdbufs--;

		cmdbufs++;
@@ -402,11 +427,35 @@ int tegra_drm_submit(struct tegra_drm_context *context, 


	/* copy and resolve relocations from submit */

	while (num_relocs--) {

		struct host1x_reloc *reloc;

		struct tegra_bo *obj;



		err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs],

						  &relocs[num_relocs], drm,

						  file);

		if (err < 0)

			goto fail;



		reloc = &job->relocarray[num_relocs];

		obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);



		/*

		 * The unaligned cmdbuf offset will cause an unaligned write

		 * during of the relocations patching, corrupting the commands

		 * stream.

		 */

		if (reloc->cmdbuf.offset & 3 ||

		    reloc->cmdbuf.offset >= obj->gem.size) {

			err = -EINVAL;

			goto fail;

		}



		obj = host1x_to_tegra_bo(reloc->target.bo);



		if (reloc->target.offset >= obj->gem.size) {

			err = -EINVAL;

			goto fail;

		}

	}



	if (copy_from_user(job->waitchk, waitchks,

drivers/gpu/drm/tegra/gem.c

+0 −5
Original line number Diff line number Diff line
@@ -20,11 +20,6 @@ 
#include "drm.h"

#include "gem.h"



static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)

{

	return container_of(bo, struct tegra_bo, base);

}



static void tegra_bo_put(struct host1x_bo *bo)

{

	struct tegra_bo *obj = host1x_to_tegra_bo(bo);

drivers/gpu/drm/tegra/gem.h

+5 −0
Original line number Diff line number Diff line
@@ -52,6 +52,11 @@ static inline struct tegra_bo *to_tegra_bo(struct drm_gem_object *gem) 
	return container_of(gem, struct tegra_bo, gem);

}



static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)

{

	return container_of(bo, struct tegra_bo, base);

}



struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size,

				 unsigned long flags);

struct tegra_bo *tegra_bo_create_with_handle(struct drm_file *file,

CRA Git | Maintained and supported by SUSTech CRA and CCSE