All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/i915: Sanity check mmap length against object size
@ 2019-03-14  7:58 Chris Wilson
  2019-03-14  8:43 ` ✓ Fi.CI.BAT: success for " Patchwork
                   ` (7 more replies)
  0 siblings, 8 replies; 13+ messages in thread
From: Chris Wilson @ 2019-03-14  7:58 UTC (permalink / raw)
  To: intel-gfx
  Cc: Chris Wilson, Antonio Argenziano, Joonas Lahtinen,
	Tvrtko Ursulin, stable

We assumed that vm_mmap() would reject an attempt to mmap past the end of
the filp (our object), but we were wrong.

Reported-by: Antonio Argenziano <antonio.argenziano@intel.com>
Testcase: igt/gem_mmap/bad-size
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Antonio Argenziano <antonio.argenziano@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: stable@vger.kernel.org
---
 drivers/gpu/drm/i915/i915_gem.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b38c9531b5e8..b7086c8d4726 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1639,8 +1639,13 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 	 * pages from.
 	 */
 	if (!obj->base.filp) {
-		i915_gem_object_put(obj);
-		return -ENXIO;
+		addr = -ENXIO;
+		goto err;
+	}
+
+	if (range_overflows(args->offset, args->size, (u64)obj->base.size)) {
+		addr = -EINVAL;
+		goto err;
 	}
 
 	addr = vm_mmap(obj->base.filp, 0, args->size,
@@ -1654,8 +1659,8 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 		struct vm_area_struct *vma;
 
 		if (down_write_killable(&mm->mmap_sem)) {
-			i915_gem_object_put(obj);
-			return -EINTR;
+			addr = -EINTR;
+			goto err;
 		}
 		vma = find_vma(mm, addr);
 		if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
@@ -1673,12 +1678,10 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 	i915_gem_object_put(obj);
 
 	args->addr_ptr = (u64)addr;
-
 	return 0;
 
 err:
 	i915_gem_object_put(obj);
-
 	return addr;
 }
 
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2019-03-25  0:38 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-14  7:58 [PATCH] drm/i915: Sanity check mmap length against object size Chris Wilson
2019-03-14  8:43 ` ✓ Fi.CI.BAT: success for " Patchwork
2019-03-14 11:33 ` [Intel-gfx] [PATCH] " Tvrtko Ursulin
2019-03-14 11:44   ` Chris Wilson
2019-03-18 12:10     ` Chris Wilson
2019-03-18 12:16       ` Chris Wilson
2019-03-14 17:41 ` ✗ Fi.CI.IGT: failure for " Patchwork
2019-03-15 18:24 ` ✓ Fi.CI.BAT: success for drm/i915: Sanity check mmap length against object size (rev2) Patchwork
2019-03-15 20:44 ` ✓ Fi.CI.IGT: " Patchwork
2019-03-18 12:17 ` [PATCH] drm/i915: Sanity check mmap length against object size Chris Wilson
2019-03-18 12:55 ` Joonas Lahtinen
2019-03-18 12:55   ` Joonas Lahtinen
2019-03-25  0:38 ` Sasha Levin

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.