All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/6] drm/amdgpu: validate size and offset of user fence BO
@ 2016-09-12 14:39 Christian König
       [not found] ` <1473691152-1693-1-git-send-email-deathsimple-ANTagKRnAhcb1SvskN2V4Q@public.gmane.org>
  0 siblings, 1 reply; 10+ messages in thread
From: Christian König @ 2016-09-12 14:39 UTC (permalink / raw)
  To: amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW

From: Christian König <christian.koenig@amd.com>

We need to validate the offset to make sure that we don't write after the BO.

Additional to that a page should be enough and can make address space
handling much easier.

Signed-off-by: Christian König <christian.koenig@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 5546a8c..ca81f15 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -91,6 +91,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 				      uint32_t *offset)
 {
 	struct drm_gem_object *gobj;
+	unsigned long size;
 
 	gobj = drm_gem_object_lookup(p->adev->ddev, p->filp,
 				     data->handle);
@@ -102,6 +103,11 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 	p->uf_entry.tv.bo = &p->uf_entry.robj->tbo;
 	p->uf_entry.tv.shared = true;
 	p->uf_entry.user_pages = NULL;
+
+	size = amdgpu_bo_size(p->uf_entry.robj);
+	if (size != PAGE_SIZE || (data->offset + 8) > size)
+		return -EINVAL;
+
 	*offset = data->offset;
 
 	drm_gem_object_unreference_unlocked(gobj);
-- 
2.5.0

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

^ permalink raw reply related	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2016-09-13  1:32 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-12 14:39 [PATCH 1/6] drm/amdgpu: validate size and offset of user fence BO Christian König
     [not found] ` <1473691152-1693-1-git-send-email-deathsimple-ANTagKRnAhcb1SvskN2V4Q@public.gmane.org>
2016-09-12 14:39   ` [PATCH 2/6] drm/amdgpu: add AMDGPU_BO_INVALID_OFFSET Christian König
2016-09-12 14:39   ` [PATCH 3/6] drm/amdgpu: unbind GTT only when it is bound Christian König
2016-09-12 14:39   ` [PATCH 4/6] drm/amdgpu: use explicit GTT limit for evictions Christian König
2016-09-12 14:39   ` [PATCH 5/6] drm/amdgpu: use expolicit limit fro VRAM<->GTT moves Christian König
     [not found]     ` <1473691152-1693-5-git-send-email-deathsimple-ANTagKRnAhcb1SvskN2V4Q@public.gmane.org>
2016-09-12 21:05       ` Alex Deucher
     [not found]         ` <CADnq5_O4RmFuHR4pBumsHnW=sfEmgnXg_HJQnPcqWV_KW4TeNA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-09-13  1:32           ` Michel Dänzer
2016-09-12 14:39   ` [PATCH 6/6] drm/amdgpu: add a custom GTT memory manager v2 Christian König
     [not found]     ` <1473691152-1693-6-git-send-email-deathsimple-ANTagKRnAhcb1SvskN2V4Q@public.gmane.org>
2016-09-12 21:22       ` Alex Deucher
2016-09-12 21:25       ` Felix Kuehling

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.