On Thu, Jan 09, 2020 at 02:11:52PM +0000, Chris Wilson wrote: > Quite understandably, we bug out when asked to find a page that doesn't > belong to the object. However, we should report the error back to the > user long before we attempt the out-of-bound access! In this case, it is > insufficient validation on the rotated vma, with the simplest/cheapest > point for us to insert a bound check when we are computing the rotated > page lookups. > > Similarly, it might be wise to see if we can validate the user input > upon creating the rotated framebuffer. We do. Did someone break it? > > Closes: https://gitlab.freedesktop.org/drm/intel/issues/951 > Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> > Cc: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx> > Cc: Matthew Auld <matthew.auld@xxxxxxxxx > --- > drivers/gpu/drm/i915/gt/intel_ggtt.c | 21 ++++++++++++++++++--- > 1 file changed, 18 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt.c b/drivers/gpu/drm/i915/gt/intel_ggtt.c > index 99189cdba8a9..59a60968a6da 100644 > --- a/drivers/gpu/drm/i915/gt/intel_ggtt.c > +++ b/drivers/gpu/drm/i915/gt/intel_ggtt.c > @@ -1283,6 +1283,7 @@ static noinline struct sg_table * > intel_rotate_pages(struct intel_rotation_info *rot_info, > struct drm_i915_gem_object *obj) > { > + const unsigned long npages = obj->base.size >> PAGE_SHIFT; > unsigned int size = intel_rotation_info_size(rot_info); > struct sg_table *st; > struct scatterlist *sg; > @@ -1302,9 +1303,23 @@ intel_rotate_pages(struct intel_rotation_info *rot_info, > sg = st->sgl; > > for (i = 0 ; i < ARRAY_SIZE(rot_info->plane); i++) { > - sg = rotate_pages(obj, rot_info->plane[i].offset, > - rot_info->plane[i].width, rot_info->plane[i].height, > - rot_info->plane[i].stride, st, sg); > + const struct intel_remapped_plane_info *plane = > + &rot_info->plane[i]; > + unsigned long last; > + > + last = plane->offset; > + last += (plane->height - 1) * plane->stride; > + last += plane->width - 1; > + if (last >= npages) { > + ret = -EINVAL; > + goto err_sg_alloc; > + } > + > + sg = rotate_pages(obj, > + plane->offset, > + plane->width, plane->height, > + plane->stride, > + st, sg); > } > > return st; > -- > 2.25.0.rc2 -- Ville Syrjälä Intel _______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/intel-gfx
