From patchwork Thu Jan 9 14:11:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 11325799 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 86417930 for ; Thu, 9 Jan 2020 14:12:12 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6E9B7206ED for ; Thu, 9 Jan 2020 14:12:12 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6E9B7206ED Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=chris-wilson.co.uk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=intel-gfx-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 010AE6E43D; Thu, 9 Jan 2020 14:12:12 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from fireflyinternet.com (mail.fireflyinternet.com [109.228.58.192]) by gabe.freedesktop.org (Postfix) with ESMTPS id 287036E43D for ; Thu, 9 Jan 2020 14:12:10 +0000 (UTC) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=78.156.65.138; Received: from haswell.alporthouse.com (unverified [78.156.65.138]) by fireflyinternet.com (Firefly Internet (M1)) with ESMTP id 19821916-1500050 for multiple; Thu, 09 Jan 2020 14:11:53 +0000 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Thu, 9 Jan 2020 14:11:52 +0000 Message-Id: <20200109141152.975687-1-chris@chris-wilson.co.uk> X-Mailer: git-send-email 2.25.0.rc2 MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH] drm/i915/gt: Validation rotated vma bounds are within the object X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" Quite understandably, we bug out when asked to find a page that doesn't belong to the object. However, we should report the error back to the user long before we attempt the out-of-bound access! In this case, it is insufficient validation on the rotated vma, with the simplest/cheapest point for us to insert a bound check when we are computing the rotated page lookups. Similarly, it might be wise to see if we can validate the user input upon creating the rotated framebuffer. Closes: https://gitlab.freedesktop.org/drm/intel/issues/951 Signed-off-by: Chris Wilson Cc: Ville Syrjälä Cc: Matthew Auld base.size >> PAGE_SHIFT; unsigned int size = intel_rotation_info_size(rot_info); struct sg_table *st; struct scatterlist *sg; @@ -1302,9 +1303,23 @@ intel_rotate_pages(struct intel_rotation_info *rot_info, sg = st->sgl; for (i = 0 ; i < ARRAY_SIZE(rot_info->plane); i++) { - sg = rotate_pages(obj, rot_info->plane[i].offset, - rot_info->plane[i].width, rot_info->plane[i].height, - rot_info->plane[i].stride, st, sg); + const struct intel_remapped_plane_info *plane = + &rot_info->plane[i]; + unsigned long last; + + last = plane->offset; + last += (plane->height - 1) * plane->stride; + last += plane->width - 1; + if (last >= npages) { + ret = -EINVAL; + goto err_sg_alloc; + } + + sg = rotate_pages(obj, + plane->offset, + plane->width, plane->height, + plane->stride, + st, sg); } return st;