|
 |
99ffffe |
From: Eric Anholt <eric@anholt.net>
|
|
|
99ffffe |
To: dri-devel@lists.freedesktop.org
|
|
|
99ffffe |
Subject: [PATCH 1/2] drm/vc4: Fix an integer overflow in temporary
|
|
|
99ffffe |
allocation layout.
|
|
|
99ffffe |
Date: Wed, 18 Jan 2017 07:20:49 +1100
|
|
|
99ffffe |
|
|
|
99ffffe |
We copy the unvalidated ioctl arguments from the user into kernel
|
|
|
99ffffe |
temporary memory to run the validation from, to avoid a race where the
|
|
|
99ffffe |
user updates the unvalidate contents in between validating them and
|
|
|
99ffffe |
copying them into the validated BO.
|
|
|
99ffffe |
|
|
|
99ffffe |
However, in setting up the layout of the kernel side, we failed to
|
|
|
99ffffe |
check one of the additions (the roundup() for shader_rec_offset)
|
|
|
99ffffe |
against integer overflow, allowing a nearly MAX_UINT value of
|
|
|
99ffffe |
bin_cl_size to cause us to under-allocate the temporary space that we
|
|
|
99ffffe |
then copy_from_user into.
|
|
|
99ffffe |
|
|
|
99ffffe |
Reported-by: Murray McAllister <murray.mcallister@insomniasec.com>
|
|
|
99ffffe |
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
|
99ffffe |
Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
|
|
|
99ffffe |
---
|
|
|
99ffffe |
drivers/gpu/drm/vc4/vc4_gem.c | 3 ++-
|
|
|
99ffffe |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
99ffffe |
|
|
|
99ffffe |
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
|
|
|
99ffffe |
index db920771bfb5..c5fe3554858e 100644
|
|
|
99ffffe |
--- a/drivers/gpu/drm/vc4/vc4_gem.c
|
|
|
99ffffe |
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
|
|
|
99ffffe |
@@ -594,7 +594,8 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
|
|
|
99ffffe |
args->shader_rec_count);
|
|
|
99ffffe |
struct vc4_bo *bo;
|
|
|
99ffffe |
|
|
|
99ffffe |
- if (uniforms_offset < shader_rec_offset ||
|
|
|
99ffffe |
+ if (shader_rec_offset < args->bin_cl_size ||
|
|
|
99ffffe |
+ uniforms_offset < shader_rec_offset ||
|
|
|
99ffffe |
exec_size < uniforms_offset ||
|
|
|
99ffffe |
args->shader_rec_count >= (UINT_MAX /
|
|
|
99ffffe |
sizeof(struct vc4_shader_state)) ||
|
|
|
99ffffe |
--
|
|
|
99ffffe |
2.11.0
|
|
|
99ffffe |
|
|
|
99ffffe |
_______________________________________________
|
|
|
99ffffe |
dri-devel mailing list
|
|
|
99ffffe |
dri-devel@lists.freedesktop.org
|
|
|
99ffffe |
https://lists.freedesktop.org/mailman/listinfo/dri-devel
|
|
|
99ffffe |
|
|
|
99ffffe |
From: Eric Anholt <eric@anholt.net>
|
|
|
99ffffe |
To: dri-devel@lists.freedesktop.org
|
|
|
99ffffe |
Subject: [PATCH 2/2] drm/vc4: Return -EINVAL on the overflow checks failing.
|
|
|
99ffffe |
Date: Wed, 18 Jan 2017 07:20:50 +1100
|
|
|
99ffffe |
|
|
|
99ffffe |
By failing to set the errno, we'd continue on to trying to set up the
|
|
|
99ffffe |
RCL, and then oops on trying to dereference the tile_bo that binning
|
|
|
99ffffe |
validation should have set up.
|
|
|
99ffffe |
|
|
|
99ffffe |
Reported-by: Ingo Molnar <mingo@kernel.org>
|
|
|
99ffffe |
Signed-off-by: Eric Anholt <eric@anholt.net>
|
|
|
99ffffe |
Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.")
|
|
|
99ffffe |
---
|
|
|
99ffffe |
drivers/gpu/drm/vc4/vc4_gem.c | 1 +
|
|
|
99ffffe |
1 file changed, 1 insertion(+)
|
|
|
99ffffe |
|
|
|
99ffffe |
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
|
|
|
99ffffe |
index c5fe3554858e..ab3016982466 100644
|
|
|
99ffffe |
--- a/drivers/gpu/drm/vc4/vc4_gem.c
|
|
|
99ffffe |
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
|
|
|
99ffffe |
@@ -601,6 +601,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
|
|
|
99ffffe |
sizeof(struct vc4_shader_state)) ||
|
|
|
99ffffe |
temp_size < exec_size) {
|
|
|
99ffffe |
DRM_ERROR("overflow in exec arguments\n");
|
|
|
99ffffe |
+ ret = -EINVAL;
|
|
|
99ffffe |
goto fail;
|
|
|
99ffffe |
}
|
|
|
99ffffe |
|
|
|
99ffffe |
--
|
|
|
99ffffe |
2.11.0
|
|
|
99ffffe |
|
|
|
99ffffe |
_______________________________________________
|
|
|
99ffffe |
dri-devel mailing list
|
|
|
99ffffe |
dri-devel@lists.freedesktop.org
|
|
|
99ffffe |
https://lists.freedesktop.org/mailman/listinfo/dri-devel
|
|
|
99ffffe |
|