drm/tegra: Check for malformed offsets and sizes in the 'submit' IOCTL

If commands buffer claims a number of words that is higher than its BO can
fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was
triggered by an opentegra Xorg driver that erroneously pushed too many
commands to the pushbuf.

The CDMA commands buffer address is 4 bytes aligned, so check its
alignment.

The maximum number of the CDMA gather fetches is 16383, add a check for
it.

Add a sanity check for the relocations in a same way.

[   46.829393] Unable to handle kernel paging request at virtual address f09b2000
...
[<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510)
[<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c)
[<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec)
[<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4)
[<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c)
[<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Erik Faye-Lund <kusmabite@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>

diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 9a1e34e48f64fb0ab684a20811a0be0ff0a09ab6..51e20e0150531f7587215b0d78552029e2609b82 100644 (file)
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -26,6 +26,7 @@
 #define DRIVER_PATCHLEVEL 0
 
 #define CARVEOUT_SZ SZ_64M
+#define CDMA_GATHER_FETCHES_MAX_NB 16383
 
 struct tegra_drm_file {
        struct idr contexts;
@@ -383,18 +384,42 @@ int tegra_drm_submit(struct tegra_drm_context *context,
        while (num_cmdbufs) {
                struct drm_tegra_cmdbuf cmdbuf;
                struct host1x_bo *bo;
+               struct tegra_bo *obj;
+               u64 offset;
 
                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
                        err = -EFAULT;
                        goto fail;
                }
 
+               /*
+                * The maximum number of CDMA gather fetches is 16383, a higher
+                * value means the words count is malformed.
+                */
+               if (cmdbuf.words > CDMA_GATHER_FETCHES_MAX_NB) {
+                       err = -EINVAL;
+                       goto fail;
+               }
+
                bo = host1x_bo_lookup(file, cmdbuf.handle);
                if (!bo) {
                        err = -ENOENT;
                        goto fail;
                }
 
+               offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32);
+               obj = host1x_to_tegra_bo(bo);
+
+               /*
+                * Gather buffer base address must be 4-bytes aligned,
+                * unaligned offset is malformed and cause commands stream
+                * corruption on the buffer address relocation.
+                */
+               if (offset & 3 || offset >= obj->gem.size) {
+                       err = -EINVAL;
+                       goto fail;
+               }
+
                host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);
                num_cmdbufs--;
                cmdbufs++;
@@ -402,11 +427,35 @@ int tegra_drm_submit(struct tegra_drm_context *context,
 
        /* copy and resolve relocations from submit */
        while (num_relocs--) {
+               struct host1x_reloc *reloc;
+               struct tegra_bo *obj;
+
                err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
                                                  &relocs[num_relocs], drm,
                                                  file);
                if (err < 0)
                        goto fail;
+
+               reloc = &job->relocarray[num_relocs];
+               obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
+
+               /*
+                * The unaligned cmdbuf offset will cause an unaligned write
+                * during of the relocations patching, corrupting the commands
+                * stream.
+                */
+               if (reloc->cmdbuf.offset & 3 ||
+                   reloc->cmdbuf.offset >= obj->gem.size) {
+                       err = -EINVAL;
+                       goto fail;
+               }
+
+               obj = host1x_to_tegra_bo(reloc->target.bo);
+
+               if (reloc->target.offset >= obj->gem.size) {
+                       err = -EINVAL;
+                       goto fail;
+               }
        }
 
        if (copy_from_user(job->waitchk, waitchks,

diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index 424569b53e5701538e1b6c9dcbfc0d9a36376d4a..7a39a355678a444d1cf1477ee932339169006957 100644 (file)
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -20,11 +20,6 @@
 #include "drm.h"
 #include "gem.h"
 
-static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
-{
-       return container_of(bo, struct tegra_bo, base);
-}
-
 static void tegra_bo_put(struct host1x_bo *bo)
 {
        struct tegra_bo *obj = host1x_to_tegra_bo(bo);

diff --git a/drivers/gpu/drm/tegra/gem.h b/drivers/gpu/drm/tegra/gem.h
index 6c5f12ac0087a0b8baf538f435d244f2ffa1537b..8b32a6fd586da6c38d9de2556ac887065d3e4a5c 100644 (file)
--- a/drivers/gpu/drm/tegra/gem.h
+++ b/drivers/gpu/drm/tegra/gem.h
@@ -52,6 +52,11 @@ static inline struct tegra_bo *to_tegra_bo(struct drm_gem_object *gem)
        return container_of(gem, struct tegra_bo, gem);
 }
 
+static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
+{
+       return container_of(bo, struct tegra_bo, base);
+}
+
 struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size,
                                 unsigned long flags);
 struct tegra_bo *tegra_bo_create_with_handle(struct drm_file *file,