From patchwork Thu Jul 11 13:53:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tvrtko Ursulin X-Patchwork-Id: 13730741 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 924C6C3DA45 for ; Thu, 11 Jul 2024 13:53:48 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 9806110EA8D; Thu, 11 Jul 2024 13:53:45 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=igalia.com header.i=@igalia.com header.b="mivHRjbE"; dkim-atps=neutral Received: from fanzine2.igalia.com (fanzine.igalia.com [178.60.130.6]) by gabe.freedesktop.org (Postfix) with ESMTPS id C9C4910EA86 for ; Thu, 11 Jul 2024 13:53:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Content-Transfer-Encoding:Content-Type:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Q7iLfP5wFpU1dyTQ8u//pl8Ug2inPHMvEM/15Lwrp4U=; b=mivHRjbEEOrr3qEZpIpCULDpG6 u9D8N5qn8LDoTWbM9041NW4RnBlf9biZuugjY5QWKlu6mVY7OG2k9EpoxRvJMGQbIvLFzR82j7fRc RQC2KhyRc9f1FCsp4rPqrRLekKCMWqGyou0IDGxkclDjX8yI5N9xFNt+v6ic9PS9GeObUhYl/R3AP UbdPjYweCmzH7O0d46PcAWiAfjmhl088e5qNtBOKKXVVx+B5LLmydtFmdhhDYwmCPhNyJSo0Qz8N+ YHfdk//KGhiqVOHwqRS5gH8FouA2FtTIVdmWMtjqQn/0SBpLSQf+gACO4FbP2QBgJauhKH7nJvciD IUfstTpA==; Received: from [84.69.19.168] (helo=localhost) by fanzine2.igalia.com with esmtpsa (Cipher TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim) id 1sRuEx-00Dieq-1R; Thu, 11 Jul 2024 15:53:43 +0200 From: Tvrtko Ursulin To: dri-devel@lists.freedesktop.org Cc: =?utf-8?q?Ma=C3=ADra_Canal?= , kernel-dev@igalia.com, Tvrtko Ursulin , Iago Toral Quiroga , stable@vger.kernel.org Subject: [PATCH 01/11] drm/v3d: Prevent out of bounds access in performance query extensions Date: Thu, 11 Jul 2024 14:53:30 +0100 Message-ID: <20240711135340.84617-2-tursulin@igalia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240711135340.84617-1-tursulin@igalia.com> References: <20240711135340.84617-1-tursulin@igalia.com> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" From: Tvrtko Ursulin Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into. Signed-off-by: Tvrtko Ursulin Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job") Cc: Maíra Canal Cc: Iago Toral Quiroga Cc: # v6.8+ Reviewed-by: Iago Toral Quiroga Reviewed-by: Maíra Canal --- drivers/gpu/drm/v3d/v3d_submit.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c index 88f63d526b22..263fefc1d04f 100644 --- a/drivers/gpu/drm/v3d/v3d_submit.c +++ b/drivers/gpu/drm/v3d/v3d_submit.c @@ -637,6 +637,9 @@ v3d_get_cpu_reset_performance_params(struct drm_file *file_priv, if (copy_from_user(&reset, ext, sizeof(reset))) return -EFAULT; + if (reset.nperfmons > V3D_MAX_PERFMONS) + return -EINVAL; + job->job_type = V3D_CPU_JOB_TYPE_RESET_PERFORMANCE_QUERY; job->performance_query.queries = kvmalloc_array(reset.count, @@ -708,6 +711,9 @@ v3d_get_cpu_copy_performance_query_params(struct drm_file *file_priv, if (copy.pad) return -EINVAL; + if (copy.nperfmons > V3D_MAX_PERFMONS) + return -EINVAL; + job->job_type = V3D_CPU_JOB_TYPE_COPY_PERFORMANCE_QUERY; job->performance_query.queries = kvmalloc_array(copy.count,