iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm/i915
History
Mastan Katragadda 661412e301 drm/i915/gem: add missing boundary check in vm_access 
A missing bounds check in vm_access() can lead to an out-of-bounds read
or write in the adjacent memory area, since the len attribute is not
validated before the memcpy later in the function, potentially hitting:

[  183.637831] BUG: unable to handle page fault for address: ffffc90000c86000
[  183.637934] #PF: supervisor read access in kernel mode
[  183.637997] #PF: error_code(0x0000) - not-present page
[  183.638059] PGD 100000067 P4D 100000067 PUD 100258067 PMD 106341067 PTE 0
[  183.638144] Oops: 0000 [#2] PREEMPT SMP NOPTI
[  183.638201] CPU: 3 PID: 1790 Comm: poc Tainted: G      D           5.17.0-rc6-ci-drm-11296+ #1
[  183.638298] Hardware name: Intel Corporation CoffeeLake Client Platform/CoffeeLake H DDR4 RVP, BIOS CNLSFWR1.R00.X208.B00.1905301319 05/30/2019
[  183.638430] RIP: 0010:memcpy_erms+0x6/0x10
[  183.640213] RSP: 0018:ffffc90001763d48 EFLAGS: 00010246
[  183.641117] RAX: ffff888109c14000 RBX: ffff888111bece40 RCX: 0000000000000ffc
[  183.642029] RDX: 0000000000001000 RSI: ffffc90000c86000 RDI: ffff888109c14004
[  183.642946] RBP: 0000000000000ffc R08: 800000000000016b R09: 0000000000000000
[  183.643848] R10: ffffc90000c85000 R11: 0000000000000048 R12: 0000000000001000
[  183.644742] R13: ffff888111bed190 R14: ffff888109c14000 R15: 0000000000001000
[  183.645653] FS:  00007fe5ef807540(0000) GS:ffff88845b380000(0000) knlGS:0000000000000000
[  183.646570] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  183.647481] CR2: ffffc90000c86000 CR3: 000000010ff02006 CR4: 00000000003706e0
[  183.648384] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  183.649271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  183.650142] Call Trace:
[  183.650988]  <TASK>
[  183.651793]  vm_access+0x1f0/0x2a0 [i915]
[  183.652726]  __access_remote_vm+0x224/0x380
[  183.653561]  mem_rw.isra.0+0xf9/0x190
[  183.654402]  vfs_read+0x9d/0x1b0
[  183.655238]  ksys_read+0x63/0xe0
[  183.656065]  do_syscall_64+0x38/0xc0
[  183.656882]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  183.657663] RIP: 0033:0x7fe5ef725142
[  183.659351] RSP: 002b:00007ffe1e81c7e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  183.660227] RAX: ffffffffffffffda RBX: 0000557055dfb780 RCX: 00007fe5ef725142
[  183.661104] RDX: 0000000000001000 RSI: 00007ffe1e81d880 RDI: 0000000000000005
[  183.661972] RBP: 00007ffe1e81e890 R08: 0000000000000030 R09: 0000000000000046
[  183.662832] R10: 0000557055dfc2e0 R11: 0000000000000246 R12: 0000557055dfb1c0
[  183.663691] R13: 00007ffe1e81e980 R14: 0000000000000000 R15: 0000000000000000

Changes since v1:
     - Updated if condition with range_overflows_t [Chris Wilson]

Fixes: 9f909e215fea ("drm/i915: Implement vm_ops->access for gdb access into mmaps")
Signed-off-by: Mastan Katragadda <mastanx.katragadda@intel.com>
Suggested-by: Adam Zabrocki <adamza@microsoft.com>
Reported-by: Jackson Cody <cody.jackson@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Jon Bloomfield <jon.bloomfield@intel.com>
Cc: Sudeep Dutt <sudeep.dutt@intel.com>
Cc: <stable@vger.kernel.org> # v5.8+
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
[mauld: tidy up the commit message and add Cc: stable]
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220303060428.1668844-1-mastanx.katragadda@intel.com
2022-03-11 10:28:20 +00:00
..
display
drm/i915/fbdev: fixup setting screen_size
2022-03-07 09:23:18 +00:00
gem
drm/i915/gem: add missing boundary check in vm_access
2022-03-11 10:28:20 +00:00
gt
drm/i915/xehp: Drop aux table invalidation on FlatCCS platforms
2022-03-08 11:28:15 -08:00
gvt
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
pxp
drm/i915/pxp: prefer forward declaration over includes
2022-02-21 13:08:58 +02:00
selftests
drm/i915: Remove the vm open count
2022-03-07 08:50:03 +01:00
.gitignore
…
i915_active_types.h
drm/i915/active: remove useless i915_utils.h include
2021-12-13 12:04:44 +02:00
i915_active.c
drm/i915: Remove unused bits of i915_vma/active api
2021-12-20 16:26:09 +01:00
i915_active.h
drm/i915: Remove unused bits of i915_vma/active api
2021-12-20 16:26:09 +01:00
i915_cmd_parser.c
drm/i915: don't include drm_cache.h in i915_drv.h
2022-02-14 13:19:37 +02:00
i915_cmd_parser.h
drm/i915: split out i915_cmd_parser.h from i915_drv.h
2022-01-10 15:43:09 +02:00
i915_config.c
drm/i915: remove IS_ACTIVE
2021-10-07 11:04:05 -07:00
i915_debugfs_params.c
drm/i915: Use to_gt() helper
2021-12-17 21:51:59 -08:00
i915_debugfs_params.h
…
i915_debugfs.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_debugfs.h
…
i915_deps.c
drm/i915: Break out the i915_deps utility
2021-12-22 08:52:57 +01:00
i915_deps.h
drm/i915: Break out the i915_deps utility
2021-12-22 08:52:57 +01:00
i915_driver.c
Merge drm/drm-next into drm-intel-gt-next
2022-02-25 13:44:44 +00:00
i915_driver.h
drm/i915: move the DRIVER_* macros to i915_driver.[ch]
2022-02-10 11:44:25 +02:00
i915_drv.h
drm/i915/xehp: Support platforms with CCS engines but no RCS
2022-03-04 08:02:15 -08:00
i915_file_private.h
drm/i915: split out i915_file_private.h from i915_drv.h
2022-02-14 13:16:28 +02:00
i915_fixed.h
…
i915_gem_evict.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_gem_evict.h
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_gem_gtt.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_gem_gtt.h
drm/i915: Remove short-term pins from execbuf, v6.
2022-01-18 12:19:30 +01:00
i915_gem_ww.c
…
i915_gem_ww.h
…
i915_gem.c
drm/i915/gem: Remove some unnecessary code
2022-03-07 08:51:18 +01:00
i915_gem.h
…
i915_getparam.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_getparam.h
drm/i915: split out i915_getparam.h from i915_drv.h
2022-01-10 15:43:05 +02:00
i915_gpu_error.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_gpu_error.h
drm/i915: move i915_reset_count()/i915_reset_engine_count() out of i915_drv.h
2022-02-14 13:07:11 +02:00
i915_ioc32.c
drm/i915: split out i915_getparam.h from i915_drv.h
2022-01-10 15:43:05 +02:00
i915_ioc32.h
…
i915_ioctl.c
drm/i915: split out i915_reg_read_ioctl() to i915_ioctl.[ch]
2022-01-21 09:59:22 +02:00
i915_ioctl.h
drm/i915: split out i915_reg_read_ioctl() to i915_ioctl.[ch]
2022-01-21 09:59:22 +02:00
i915_iosf_mbi.h
drm/i915: abstraction for iosf to compile on all archs
2021-10-27 00:32:01 -07:00
i915_irq.c
drm/i915/reg: split out icl_dsi_regs.h
2022-02-21 12:06:15 +02:00
i915_irq.h
drm/i915/hpd: hide struct intel_hotplug_funcs
2022-02-09 13:39:35 +02:00
i915_memcpy.c
…
i915_memcpy.h
…
i915_mitigations.c
drm/i915: move the DRIVER_* macros to i915_driver.[ch]
2022-02-10 11:44:25 +02:00
i915_mitigations.h
…
i915_mm.c
drm/i915: Skip remap_io_mapping() for non-x86 platforms
2021-12-08 13:26:14 -08:00
i915_mm.h
drm/i915: Fix header test for !CONFIG_X86
2022-02-03 01:06:56 -08:00
i915_module.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_params.c
drm/i915: Kill the fake lmem support
2022-02-18 22:31:46 -08:00
i915_params.h
drm/i915: Kill the fake lmem support
2022-02-18 22:31:46 -08:00
i915_pci.c
Merge drm/drm-next into drm-intel-gt-next
2022-02-25 13:44:44 +00:00
i915_pci.h
…
i915_perf_oa_regs.h
drm/i915/perf: Express OA register ranges with i915_range
2022-02-02 07:52:23 -08:00
i915_perf_types.h
drm/i915: Only include i915_reg.h from .c files
2022-02-02 07:59:54 -08:00
i915_perf.c
Merge drm/drm-next into drm-intel-gt-next
2022-02-25 13:44:44 +00:00
i915_perf.h
…
i915_pmu.c
drm/i915: Move GT registers to their own header file
2022-02-02 07:59:14 -08:00
i915_pmu.h
…
i915_priolist_types.h
…
i915_pvinfo.h
…
i915_query.c
drm/i915: Use to_gt() helper
2021-12-17 21:51:59 -08:00
i915_query.h
…
i915_reg_defs.h
drm/i915: Add REG_GENMASK64() and REG_FIELD_GET64()
2022-02-16 15:00:57 +02:00
i915_reg.h
drm/i915/xehp: Define compute class and engine
2022-03-02 06:45:16 -08:00
i915_request.c
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
i915_request.h
drm/i915: Use struct vma_resource instead of struct vma_snapshot
2022-01-11 10:54:11 +01:00
i915_scatterlist.c
drm: move the buddy allocator from i915 into common drm
2022-01-19 08:17:07 +01:00
i915_scatterlist.h
drm/i915: Introduce refcounted sg-tables
2021-11-01 18:10:49 +01:00
i915_scheduler_types.h
…
i915_scheduler.c
…
i915_scheduler.h
…
i915_selftest.h
…
i915_suspend.c
drm/i915: split out PCI config space registers from i915_reg.h
2022-01-10 16:17:46 +02:00
i915_suspend.h
…
i915_sw_fence_work.c
drm/i915: Drop stealing of bits from i915_sw_fence function pointer
2021-11-30 17:52:15 -08:00
i915_sw_fence_work.h
…
i915_sw_fence.c
drm/i915: Drop stealing of bits from i915_sw_fence function pointer
2021-11-30 17:52:15 -08:00
i915_sw_fence.h
drm/i915: Drop stealing of bits from i915_sw_fence function pointer
2021-11-30 17:52:15 -08:00
i915_switcheroo.c
drm/i915/driver: add i915_driver_ prefix to functions
2021-11-17 11:47:55 +02:00
i915_switcheroo.h
…
i915_syncmap.c
…
i915_syncmap.h
…
i915_sysfs.c
drm/i915: Move GT registers to their own header file
2022-02-02 07:59:14 -08:00
i915_sysfs.h
…
i915_trace_points.c
…
i915_trace.h
drm/i915/trace: split out display trace to a separate file
2021-12-09 11:21:46 +02:00
i915_ttm_buddy_manager.c
drm/i915/selftests: exercise mmap migration
2022-03-01 08:50:48 +00:00
i915_ttm_buddy_manager.h
drm/i915/selftests: exercise mmap migration
2022-03-01 08:50:48 +00:00
i915_user_extensions.c
…
i915_user_extensions.h
…
i915_utils.c
…
i915_utils.h
drm/i915: nuke local versions of WARN_ON/WARN_ON_ONCE
2022-01-24 14:02:16 +02:00
i915_vgpu.c
drm/i915: Add object locking to i915_gem_evict_for_node and i915_gem_evict_something, v2.
2022-01-18 12:18:03 +01:00
i915_vgpu.h
…
i915_vma_resource.c
drm/i915: Remove the vm open count
2022-03-07 08:50:03 +01:00
i915_vma_resource.h
drm/i915: Remove the vm open count
2022-03-07 08:50:03 +01:00
i915_vma_types.h
drm/i915: Remove the vma refcount
2022-03-07 08:50:52 +01:00
i915_vma.c
drm/i915: stop checking for NULL vma->obj
2022-03-07 09:57:21 +00:00
i915_vma.h
drm/i915: Remove the vma refcount
2022-03-07 08:50:52 +01:00
intel_device_info.c
Merge drm/drm-next into drm-intel-gt-next
2022-02-25 13:44:44 +00:00
intel_device_info.h
Merge drm/drm-next into drm-intel-gt-next
2022-02-25 13:44:44 +00:00
intel_dram.c
drm/i915: Move MCHBAR registers to their own header
2022-02-16 12:29:47 -08:00
intel_dram.h
…
intel_gvt.c
drm/i915: Use to_gt() helper
2021-12-17 21:51:59 -08:00
intel_gvt.h
…
intel_mchbar_regs.h
drm/i915: Clean up SSKPD/MLTR defines
2022-02-18 08:42:17 +02:00
intel_memory_region.c
drm/i915: add io_size plumbing
2022-02-28 08:47:27 +00:00
intel_memory_region.h
drm/i915: add io_size plumbing
2022-02-28 08:47:27 +00:00
intel_pch.c
drm/i915/adl-n: Add PCH Support for Alder Lake N
2022-02-22 21:36:34 -08:00
intel_pch.h
drm/i915/adl-n: Add PCH Support for Alder Lake N
2022-02-22 21:36:34 -08:00
intel_pci_config.h
drm/i915: split out PCI config space registers from i915_reg.h
2022-01-10 16:17:46 +02:00
intel_pcode.c
drm/i915: Only include i915_reg.h from .c files
2022-02-02 07:59:54 -08:00
intel_pcode.h
drm/i915/pcode: rename sandybridge_pcode_* to snb_pcode_*
2022-01-13 15:20:57 +02:00
intel_pm_types.h
drm/i915: split out intel_pm_types.h
2021-12-03 11:28:12 +02:00
intel_pm.c
drm/i915: Pimp icl+ sagv pre/post update
2022-02-18 21:36:26 +02:00
intel_pm.h
drm/i915: Workaround broken BIOS DBUF configuration on TGL/RKL
2022-02-07 11:10:32 +02:00
intel_region_ttm.c
drm/i915/buddy: track available visible size
2022-02-28 08:47:34 +00:00
intel_region_ttm.h
drm/i915/ttm: Drop region reference counting
2021-11-25 09:36:16 +01:00
intel_runtime_pm.c
drm/i915/selftests: Disable runtime pm wakeref tracking for the mock device
2022-02-11 13:22:10 +02:00
intel_runtime_pm.h
drm/i915/selftests: Disable runtime pm wakeref tracking for the mock device
2022-02-11 13:22:10 +02:00
intel_sbi.c
drm/i915: Only include i915_reg.h from .c files
2022-02-02 07:59:54 -08:00
intel_sbi.h
drm/i915: rename intel_sideband.[ch] to intel_sbi.[ch]
2021-10-14 18:05:04 +03:00
intel_step.c
drm/i915/tgl: Simply subplatform detection
2022-02-23 07:41:57 -08:00
intel_step.h
drm/i915: Rename GT_STEP to GRAPHICS_STEP
2021-11-02 13:05:40 -07:00
intel_uncore.c
drm/i915/gt: Use parameterized RING_MI_MODE
2022-02-16 12:29:46 -08:00
intel_uncore.h
drm/i915: Only include i915_reg.h from .c files
2022-02-02 07:59:54 -08:00
intel_wakeref.c
…
intel_wakeref.h
drm/i915/guc: Take engine PM when a context is pinned with GuC submission
2021-10-15 10:37:26 -07:00
intel_wopcm.c
drm/i915/wopcm: Handle pre-programmed WOPCM registers
2022-01-26 11:47:24 -08:00
intel_wopcm.h
…
Kconfig
drm/i915: Depend on !PREEMPT_RT.
2022-03-02 11:26:17 +00:00
Kconfig.debug
…
Kconfig.profile
…
Kconfig.unstable
drm/i915: Kill the fake lmem support
2022-02-18 22:31:46 -08:00
Makefile
Merge tag 'drm-intel-gt-next-2022-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-intel-next
2022-02-23 15:03:51 -05:00
TODO.txt
…
vlv_sideband_reg.h
drm/i915: split out vlv sideband registers from i915_reg.h
2022-01-10 16:17:50 +02:00
vlv_sideband.c
drm/i915: Only include i915_reg.h from .c files
2022-02-02 07:59:54 -08:00
vlv_sideband.h
drm/i915: split out vlv sideband registers from i915_reg.h
2022-01-10 16:17:50 +02:00
vlv_suspend.c
drm/i915: Move GT registers to their own header file
2022-02-02 07:59:14 -08:00
vlv_suspend.h
…