@@ -1266,6 +1266,7 @@ static noinline struct sg_table *
intel_rotate_pages(struct intel_rotation_info *rot_info,
struct drm_i915_gem_object *obj)
{
+ const unsigned long npages = obj->base.size >> PAGE_SHIFT;
unsigned int size = intel_rotation_info_size(rot_info);
struct sg_table *st;
struct scatterlist *sg;
@@ -1285,9 +1286,26 @@ intel_rotate_pages(struct intel_rotation_info *rot_info,
sg = st->sgl;
for (i = 0 ; i < ARRAY_SIZE(rot_info->plane); i++) {
- sg = rotate_pages(obj, rot_info->plane[i].offset,
- rot_info->plane[i].width, rot_info->plane[i].height,
- rot_info->plane[i].stride, st, sg);
+ const struct intel_remapped_plane_info *plane =
+ &rot_info->plane[i];
+ unsigned long last;
+
+ if (!plane->height || !plane->width)
+ continue;
+
+ last = plane->offset;
+ last += (plane->height - 1) * plane->stride;
+ last += plane->width - 1;
+ if (last >= npages) {
+ ret = -EINVAL;
+ goto err_sg_alloc;
+ }
+
+ sg = rotate_pages(obj,
+ plane->offset,
+ plane->width, plane->height,
+ plane->stride,
+ st, sg);
}
return st;
@@ -1295,7 +1313,6 @@ intel_rotate_pages(struct intel_rotation_info *rot_info,
err_sg_alloc:
kfree(st);
err_st_alloc:
-
DRM_DEBUG_DRIVER("Failed to create rotated mapping for object size %zu! (%ux%u tiles, %u pages)\n",
obj->base.size, rot_info->plane[0].width, rot_info->plane[0].height, size);
@@ -962,6 +962,7 @@ static int igt_vma_remapped_gtt(void *arg)
*t == I915_GGTT_VIEW_ROTATED ? "Rotated" : "Remapped",
val, exp);
i915_vma_unpin_iomap(vma);
+ err = -EINVAL;
goto out;
}
}
Quite understandably, we bug out when asked to find a page that doesn't belong to the object. However, we should report the error back to the user long before we attempt the out-of-bound access! In this case, it is insufficient validation on the rotated vma, with the simplest/cheapest point for us to insert a bound check when we are computing the rotated page lookups. Similarly, it might be wise to see if we can validate the user input upon creating the rotated framebuffer. v2: Skip empty planes Closes: https://gitlab.freedesktop.org/drm/intel/issues/951 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Matthew Auld <matthew.auld@intel.com --- drivers/gpu/drm/i915/gt/intel_ggtt.c | 25 +++++++++++++++++++---- drivers/gpu/drm/i915/selftests/i915_vma.c | 1 + 2 files changed, 22 insertions(+), 4 deletions(-)