[PATCH 3/3] drm/tegra: Check size of a submitted command buffer

[Dmitry Osipenko]

If command buffer claims a number of words that is higher than its BO can
fit and a relocation lays past the BO, a kernel OOPS will be fired on that
relocation address patching. This was triggered by an opentegra Xorg driver
that erroneously pushed too many commands to the pushbuf.

[   46.829393] Unable to handle kernel paging request at virtual address 
f09b2000
...
[] (host1x_job_pin) from [] (tegra_drm_submit+0x474/0x510)
[] (tegra_drm_submit) from [] (tegra_submit+0x50/0x6c)
[] (tegra_submit) from [] (drm_ioctl+0x1e4/0x3ec)
[] (drm_ioctl) from [] (do_vfs_ioctl+0x9c/0x8e4)
[] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c)
[] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c)

Signed-off-by: Dmitry Osipenko 
---
 drivers/gpu/drm/tegra/drm.c | 18 ++
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 732c8d98044f..e9c74a7780e7 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -361,20 +361,30 @@ int tegra_drm_submit(struct tegra_drm_context *context,
 
while (num_cmdbufs) {
struct drm_tegra_cmdbuf cmdbuf;
-   struct host1x_bo *bo;
+   struct drm_gem_object *gem;
+   struct tegra_bo *bo;
 
if (copy_from_user(, cmdbufs, sizeof(cmdbuf))) {
err = -EFAULT;
goto fail;
}
 
-   bo = host1x_bo_lookup(file, cmdbuf.handle);
-   if (!bo) {
+   gem = drm_gem_object_lookup(file, cmdbuf.handle);
+   if (!gem) {
err = -ENOENT;
goto fail;
}
 
-   host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);
+   drm_gem_object_unreference_unlocked(gem);
+
+   if (cmdbuf.words * 4 > gem->size) {
+   err = -EINVAL;
+   goto fail;
+   }
+
+   bo = to_tegra_bo(gem);
+   host1x_job_add_gather(job, >base,
+ cmdbuf.words, cmdbuf.offset);
num_cmdbufs--;
cmdbufs++;
}
-- 
2.12.2

___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 3/3] drm/tegra: Check size of a submitted command buffer

[Dmitry Osipenko]

On 12.05.2017 22:06, Erik Faye-Lund wrote:
> On Fri, May 12, 2017 at 9:02 PM, Dmitry Osipenko  wrote:
>> +   if (cmdbuf.words * 4 > gem->size) {
> 
> Shouldn't this be "cmdbuf.offset + cmdbuf.words * 4 > gem->size"?
> 

Seems yes, good catch. Thank you :)

-- 
Dmitry
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH 3/3] drm/tegra: Check size of a submitted command buffer

[Erik Faye-Lund]

On Fri, May 12, 2017 at 9:02 PM, Dmitry Osipenko  wrote:
> If command buffer claims a number of words that is higher than its BO can
> fit and a relocation lays past the BO, a kernel OOPS will be fired on that
> relocation address patching. This was triggered by an opentegra Xorg driver
> that erroneously pushed too many commands to the pushbuf.
>
> [   46.829393] Unable to handle kernel paging request at virtual address 
> f09b2000
> ...
> [] (host1x_job_pin) from [] (tegra_drm_submit+0x474/0x510)
> [] (tegra_drm_submit) from [] (tegra_submit+0x50/0x6c)
> [] (tegra_submit) from [] (drm_ioctl+0x1e4/0x3ec)
> [] (drm_ioctl) from [] (do_vfs_ioctl+0x9c/0x8e4)
> [] (do_vfs_ioctl) from [] (SyS_ioctl+0x34/0x5c)
> [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c)
>
> Signed-off-by: Dmitry Osipenko 
> ---
>  drivers/gpu/drm/tegra/drm.c | 18 ++
>  1 file changed, 14 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
> index 732c8d98044f..e9c74a7780e7 100644
> --- a/drivers/gpu/drm/tegra/drm.c
> +++ b/drivers/gpu/drm/tegra/drm.c
> @@ -361,20 +361,30 @@ int tegra_drm_submit(struct tegra_drm_context *context,
>
> while (num_cmdbufs) {
> struct drm_tegra_cmdbuf cmdbuf;
> -   struct host1x_bo *bo;
> +   struct drm_gem_object *gem;
> +   struct tegra_bo *bo;
>
> if (copy_from_user(, cmdbufs, sizeof(cmdbuf))) {
> err = -EFAULT;
> goto fail;
> }
>
> -   bo = host1x_bo_lookup(file, cmdbuf.handle);
> -   if (!bo) {
> +   gem = drm_gem_object_lookup(file, cmdbuf.handle);
> +   if (!gem) {
> err = -ENOENT;
> goto fail;
> }
>
> -   host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);
> +   drm_gem_object_unreference_unlocked(gem);
> +
> +   if (cmdbuf.words * 4 > gem->size) {

Shouldn't this be "cmdbuf.offset + cmdbuf.words * 4 > gem->size"?
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel