* [PATCH] gpu: host1x: Do not leak BO's phys address to userspace
@ 2017-05-14 20:47 Dmitry Osipenko
[not found] ` <20170514204734.22130-1-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
0 siblings, 1 reply; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-14 20:47 UTC (permalink / raw)
To: Thierry Reding, Mikko Perttunen
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
Do gathers coping before patching them, so the original gathers are left
untouched. That's not as bad as leaking a kernel addresses, but still
doesn't feel right.
Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
drivers/gpu/host1x/job.c | 46 ++++++++++++++++++++++++++++++----------------
1 file changed, 30 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
index d9933828fe87..8f0d43b8f9a6 100644
--- a/drivers/gpu/host1x/job.c
+++ b/drivers/gpu/host1x/job.c
@@ -137,8 +137,9 @@ static void host1x_syncpt_patch_offset(struct host1x_syncpt *sp,
* avoid a wrap condition in the HW).
*/
static int do_waitchks(struct host1x_job *job, struct host1x *host,
- struct host1x_bo *patch)
+ struct host1x_job_gather *g)
{
+ struct host1x_bo *patch = g->bo;
int i;
/* compare syncpt vs wait threshold */
@@ -165,7 +166,8 @@ static int do_waitchks(struct host1x_job *job, struct host1x *host,
wait->syncpt_id, sp->name, wait->thresh,
host1x_syncpt_read_min(sp));
- host1x_syncpt_patch_offset(sp, patch, wait->offset);
+ host1x_syncpt_patch_offset(sp, patch,
+ g->offset + wait->offset);
}
wait->bo = NULL;
@@ -269,11 +271,12 @@ static unsigned int pin_job(struct host1x *host, struct host1x_job *job)
return err;
}
-static int do_relocs(struct host1x_job *job, struct host1x_bo *cmdbuf)
+static int do_relocs(struct host1x_job *job, struct host1x_job_gather *g)
{
int i = 0;
u32 last_page = ~0;
void *cmdbuf_page_addr = NULL;
+ struct host1x_bo *cmdbuf = g->bo;
/* pin & patch the relocs for one gather */
for (i = 0; i < job->num_relocs; i++) {
@@ -286,7 +289,8 @@ static int do_relocs(struct host1x_job *job, struct host1x_bo *cmdbuf)
if (cmdbuf != reloc->cmdbuf.bo)
continue;
- if (last_page != reloc->cmdbuf.offset >> PAGE_SHIFT) {
+ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) &&
+ last_page != reloc->cmdbuf.offset >> PAGE_SHIFT) {
if (cmdbuf_page_addr)
host1x_bo_kunmap(cmdbuf, last_page,
cmdbuf_page_addr);
@@ -301,11 +305,20 @@ static int do_relocs(struct host1x_job *job, struct host1x_bo *cmdbuf)
}
}
+ if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) {
+ cmdbuf_page_addr = job->gather_copy_mapped;
+ cmdbuf_page_addr += g->offset;
+ }
+
target = cmdbuf_page_addr + (reloc->cmdbuf.offset & ~PAGE_MASK);
+
+ if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL))
+ target += (reloc->cmdbuf.offset & PAGE_MASK) >> 2;
+
*target = reloc_addr;
}
- if (cmdbuf_page_addr)
+ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && cmdbuf_page_addr)
host1x_bo_kunmap(cmdbuf, last_page, cmdbuf_page_addr);
return 0;
@@ -573,6 +586,14 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev)
if (err)
goto out;
+ if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && !err) {
+ err = copy_gathers(job, dev);
+ if (err) {
+ host1x_job_unpin(job);
+ return err;
+ }
+ }
+
/* patch gathers */
for (i = 0; i < job->num_gathers; i++) {
struct host1x_job_gather *g = &job->gathers[i];
@@ -581,7 +602,8 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev)
if (g->handled)
continue;
- g->base = job->gather_addr_phys[i];
+ if (!IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL))
+ g->base = job->gather_addr_phys[i];
for (j = i + 1; j < job->num_gathers; j++) {
if (job->gathers[j].bo == g->bo) {
@@ -590,23 +612,15 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev)
}
}
- err = do_relocs(job, g->bo);
+ err = do_relocs(job, g);
if (err)
break;
- err = do_waitchks(job, host, g->bo);
+ err = do_waitchks(job, host, g);
if (err)
break;
}
- if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && !err) {
- err = copy_gathers(job, dev);
- if (err) {
- host1x_job_unpin(job);
- return err;
- }
- }
-
out:
wmb();
--
2.13.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH] drm/tegra: Check whether page belongs to BO in tegra_bo_kmap()
[not found] ` <20170514204734.22130-1-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
@ 2017-05-14 20:47 ` Dmitry Osipenko
[not found] ` <20170514204734.22130-2-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-14 20:47 ` [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations Dmitry Osipenko
2017-05-14 20:47 ` [PATCH v2] drm/tegra: Correct idr_alloc() minimum id Dmitry Osipenko
2 siblings, 1 reply; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-14 20:47 UTC (permalink / raw)
To: Thierry Reding, Mikko Perttunen
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
This fixes an OOPS in case of out-of-bounds accessing of a kmap'ed commands
buffer CMA while patching relocations in do_relocs().
Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
drivers/gpu/drm/tegra/gem.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index 424569b53e57..b76d7ac75696 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -74,6 +74,9 @@ static void *tegra_bo_kmap(struct host1x_bo *bo, unsigned int page)
{
struct tegra_bo *obj = host1x_to_tegra_bo(bo);
+ if (page * PAGE_SIZE > obj->gem.size)
+ return NULL;
+
if (obj->vaddr)
return obj->vaddr + page * PAGE_SIZE;
else if (obj->gem.import_attach)
--
2.13.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations
[not found] ` <20170514204734.22130-1-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-14 20:47 ` [PATCH] drm/tegra: Check whether page belongs to BO in tegra_bo_kmap() Dmitry Osipenko
@ 2017-05-14 20:47 ` Dmitry Osipenko
[not found] ` <20170514204734.22130-3-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-14 20:47 ` [PATCH v2] drm/tegra: Correct idr_alloc() minimum id Dmitry Osipenko
2 siblings, 1 reply; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-14 20:47 UTC (permalink / raw)
To: Thierry Reding, Mikko Perttunen
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
If commands buffer claims a number of words that is higher than its BO can
fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was
triggered by an opentegra Xorg driver that erroneously pushed too many
commands to the pushbuf. The CMDA commands buffer address is 4 bytes
aligned, so check the alignment as well.
Add a sanity check for the relocations in a same way.
[ 46.829393] Unable to handle kernel paging request at virtual address f09b2000
...
[<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510)
[<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c)
[<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec)
[<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4)
[<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c)
[<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)
Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Reviewed-by: Erik Faye-Lund <kusmabite-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
drivers/gpu/drm/tegra/gem.c | 5 -----
drivers/gpu/drm/tegra/gem.h | 5 +++++
3 files changed, 35 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 768750226452..c5844a065681 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context *context,
while (num_cmdbufs) {
struct drm_tegra_cmdbuf cmdbuf;
struct host1x_bo *bo;
+ struct tegra_bo *obj;
+ u64 offset;
if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
err = -EFAULT;
@@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context *context,
goto fail;
}
+ offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32);
+ obj = host1x_to_tegra_bo(bo);
+
+ if (offset & 3 || offset > obj->gem.size) {
+ err = -EINVAL;
+ goto fail;
+ }
+
host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);
num_cmdbufs--;
cmdbufs++;
@@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context *context,
/* copy and resolve relocations from submit */
while (num_relocs--) {
+ struct host1x_reloc *reloc;
+ struct tegra_bo *obj;
+
err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
&relocs[num_relocs], drm,
file);
if (err < 0)
goto fail;
+
+ reloc = &job->relocarray[num_relocs];
+ obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
+
+ if (reloc->cmdbuf.offset & 3 ||
+ reloc->cmdbuf.offset > obj->gem.size) {
+ err = -EINVAL;
+ goto fail;
+ }
+
+ obj = host1x_to_tegra_bo(reloc->target.bo);
+
+ if (reloc->target.offset & 3 ||
+ reloc->target.offset > obj->gem.size) {
+ err = -EINVAL;
+ goto fail;
+ }
}
if (copy_from_user(job->waitchk, waitchks,
diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index b76d7ac75696..a0ff30c01ac1 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -20,11 +20,6 @@
#include "drm.h"
#include "gem.h"
-static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
-{
- return container_of(bo, struct tegra_bo, base);
-}
-
static void tegra_bo_put(struct host1x_bo *bo)
{
struct tegra_bo *obj = host1x_to_tegra_bo(bo);
diff --git a/drivers/gpu/drm/tegra/gem.h b/drivers/gpu/drm/tegra/gem.h
index 6c5f12ac0087..8b32a6fd586d 100644
--- a/drivers/gpu/drm/tegra/gem.h
+++ b/drivers/gpu/drm/tegra/gem.h
@@ -52,6 +52,11 @@ static inline struct tegra_bo *to_tegra_bo(struct drm_gem_object *gem)
return container_of(gem, struct tegra_bo, gem);
}
+static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
+{
+ return container_of(bo, struct tegra_bo, base);
+}
+
struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size,
unsigned long flags);
struct tegra_bo *tegra_bo_create_with_handle(struct drm_file *file,
--
2.13.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH v2] drm/tegra: Correct idr_alloc() minimum id
[not found] ` <20170514204734.22130-1-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-14 20:47 ` [PATCH] drm/tegra: Check whether page belongs to BO in tegra_bo_kmap() Dmitry Osipenko
2017-05-14 20:47 ` [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations Dmitry Osipenko
@ 2017-05-14 20:47 ` Dmitry Osipenko
[not found] ` <20170514204734.22130-4-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2 siblings, 1 reply; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-14 20:47 UTC (permalink / raw)
To: Thierry Reding, Mikko Perttunen
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
The client ID 0 is reserved by the host1x/cdma to mark the timeout timer
work as already been scheduled and context ID is used as the clients one.
This fixes spurious CDMA timeouts.
Fixes: bdd2f9cd10eb ("drm/tegra: Don't leak kernel pointer to userspace")
Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
v2: Changed the commit description, now explains the cause of CDMA timeouts.
drivers/gpu/drm/tegra/drm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index c5844a065681..489cb32453f7 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -548,7 +548,7 @@ static int tegra_client_open(struct tegra_drm_file *fpriv,
if (err < 0)
return err;
- err = idr_alloc(&fpriv->contexts, context, 0, 0, GFP_KERNEL);
+ err = idr_alloc(&fpriv->contexts, context, 1, 0, GFP_KERNEL);
if (err < 0) {
client->ops->close_channel(context);
return err;
--
2.13.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/tegra: Check whether page belongs to BO in tegra_bo_kmap()
[not found] ` <20170514204734.22130-2-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
@ 2017-05-15 7:54 ` Dmitry Osipenko
0 siblings, 0 replies; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-15 7:54 UTC (permalink / raw)
To: Thierry Reding, Mikko Perttunen
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
On 14.05.2017 23:47, Dmitry Osipenko wrote:
> This fixes an OOPS in case of out-of-bounds accessing of a kmap'ed commands
> buffer CMA while patching relocations in do_relocs().
>
> Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> ---
> drivers/gpu/drm/tegra/gem.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
> index 424569b53e57..b76d7ac75696 100644
> --- a/drivers/gpu/drm/tegra/gem.c
> +++ b/drivers/gpu/drm/tegra/gem.c
> @@ -74,6 +74,9 @@ static void *tegra_bo_kmap(struct host1x_bo *bo, unsigned int page)
> {
> struct tegra_bo *obj = host1x_to_tegra_bo(bo);
>
> + if (page * PAGE_SIZE > obj->gem.size)
> + return NULL;
> +
> if (obj->vaddr)
> return obj->vaddr + page * PAGE_SIZE;
> else if (obj->gem.import_attach)
>
It should be '>=', I'll wait for the review comments before sending out a new
version of the patch.
--
Dmitry
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations
[not found] ` <20170514204734.22130-3-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
@ 2017-05-15 8:01 ` Dmitry Osipenko
2017-05-16 6:56 ` Mikko Perttunen
1 sibling, 0 replies; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-15 8:01 UTC (permalink / raw)
To: Thierry Reding, Mikko Perttunen
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
On 14.05.2017 23:47, Dmitry Osipenko wrote:
> /* copy and resolve relocations from submit */
> while (num_relocs--) {
> + struct host1x_reloc *reloc;
> + struct tegra_bo *obj;
> +
> err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
> &relocs[num_relocs], drm,
> file);
> if (err < 0)
> goto fail;
> +
> + reloc = &job->relocarray[num_relocs];
> + obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
> +
> + if (reloc->cmdbuf.offset & 3 ||
> + reloc->cmdbuf.offset > obj->gem.size) {
> + err = -EINVAL;
> + goto fail;
> + }
> +
> + obj = host1x_to_tegra_bo(reloc->target.bo);
> +
> + if (reloc->target.offset & 3 ||
> + reloc->target.offset > obj->gem.size) {
> + err = -EINVAL;
> + goto fail;
> + }
> }
The relocation offsets should be compared as '>=' as well.
--
Dmitry
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations
[not found] ` <20170514204734.22130-3-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-15 8:01 ` Dmitry Osipenko
@ 2017-05-16 6:56 ` Mikko Perttunen
[not found] ` <3db57134-4dba-e886-059c-96034192f637-/1wQRMveznE@public.gmane.org>
1 sibling, 1 reply; 12+ messages in thread
From: Mikko Perttunen @ 2017-05-16 6:56 UTC (permalink / raw)
To: Dmitry Osipenko, Thierry Reding
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
On 14.05.2017 23:47, Dmitry Osipenko wrote:
> If commands buffer claims a number of words that is higher than its BO can
> fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was
> triggered by an opentegra Xorg driver that erroneously pushed too many
> commands to the pushbuf. The CMDA commands buffer address is 4 bytes
> aligned, so check the alignment as well.
>
> Add a sanity check for the relocations in a same way.
>
> [ 46.829393] Unable to handle kernel paging request at virtual address f09b2000
> ...
> [<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510)
> [<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c)
> [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec)
> [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4)
> [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c)
> [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)
>
> Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> Reviewed-by: Erik Faye-Lund <kusmabite-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> ---
> drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
> drivers/gpu/drm/tegra/gem.c | 5 -----
> drivers/gpu/drm/tegra/gem.h | 5 +++++
> 3 files changed, 35 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
> index 768750226452..c5844a065681 100644
> --- a/drivers/gpu/drm/tegra/drm.c
> +++ b/drivers/gpu/drm/tegra/drm.c
> @@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context *context,
> while (num_cmdbufs) {
> struct drm_tegra_cmdbuf cmdbuf;
> struct host1x_bo *bo;
> + struct tegra_bo *obj;
> + u64 offset;
>
> if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
> err = -EFAULT;
> @@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context *context,
> goto fail;
> }
>
> + offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32);
> + obj = host1x_to_tegra_bo(bo);
> +
> + if (offset & 3 || offset > obj->gem.size) {
> + err = -EINVAL;
> + goto fail;
> + }
> +
> host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);
> num_cmdbufs--;
> cmdbufs++;
> @@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context *context,
>
> /* copy and resolve relocations from submit */
> while (num_relocs--) {
> + struct host1x_reloc *reloc;
> + struct tegra_bo *obj;
> +
> err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
> &relocs[num_relocs], drm,
> file);
> if (err < 0)
> goto fail;
> +
> + reloc = &job->relocarray[num_relocs];
> + obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
> +
> + if (reloc->cmdbuf.offset & 3 ||
> + reloc->cmdbuf.offset > obj->gem.size) {
This could still fail if the bo's size is not divisible by 4, even with
>= comparison (we would overwrite the buffer by 1 to 3 bytes). I would
do the same as in the gather case, i.e. find out the address immediately
after the write and compare using >. Perhaps add a helper function if it
makes sense. I also don't think the "& 3" checks are needed.
> + err = -EINVAL;
> + goto fail;
> + }
> +
> + obj = host1x_to_tegra_bo(reloc->target.bo);
> +
> + if (reloc->target.offset & 3 ||
> + reloc->target.offset > obj->gem.size) {
> + err = -EINVAL;
> + goto fail;
> + }
> }
>
> if (copy_from_user(job->waitchk, waitchks,
> diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
> index b76d7ac75696..a0ff30c01ac1 100644
> --- a/drivers/gpu/drm/tegra/gem.c
> +++ b/drivers/gpu/drm/tegra/gem.c
> @@ -20,11 +20,6 @@
> #include "drm.h"
> #include "gem.h"
>
> -static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
> -{
> - return container_of(bo, struct tegra_bo, base);
> -}
> -
> static void tegra_bo_put(struct host1x_bo *bo)
> {
> struct tegra_bo *obj = host1x_to_tegra_bo(bo);
> diff --git a/drivers/gpu/drm/tegra/gem.h b/drivers/gpu/drm/tegra/gem.h
> index 6c5f12ac0087..8b32a6fd586d 100644
> --- a/drivers/gpu/drm/tegra/gem.h
> +++ b/drivers/gpu/drm/tegra/gem.h
> @@ -52,6 +52,11 @@ static inline struct tegra_bo *to_tegra_bo(struct drm_gem_object *gem)
> return container_of(gem, struct tegra_bo, gem);
> }
>
> +static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
> +{
> + return container_of(bo, struct tegra_bo, base);
> +}
> +
> struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size,
> unsigned long flags);
> struct tegra_bo *tegra_bo_create_with_handle(struct drm_file *file,
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations
[not found] ` <3db57134-4dba-e886-059c-96034192f637-/1wQRMveznE@public.gmane.org>
@ 2017-05-16 7:32 ` Erik Faye-Lund
[not found] ` <CABPQNSYgayogP1MCTj5O4UNFrsWr5e5F9e8E0wHMU0bieW+Ocw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-05-16 8:11 ` Dmitry Osipenko
1 sibling, 1 reply; 12+ messages in thread
From: Erik Faye-Lund @ 2017-05-16 7:32 UTC (permalink / raw)
To: Mikko Perttunen
Cc: Dmitry Osipenko, Thierry Reding,
linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development
On Tue, May 16, 2017 at 8:56 AM, Mikko Perttunen <cyndis-/1wQRMveznE@public.gmane.org> wrote:
> On 14.05.2017 23:47, Dmitry Osipenko wrote:
>>
>> If commands buffer claims a number of words that is higher than its BO can
>> fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was
>> triggered by an opentegra Xorg driver that erroneously pushed too many
>> commands to the pushbuf. The CMDA commands buffer address is 4 bytes
>> aligned, so check the alignment as well.
>>
>> Add a sanity check for the relocations in a same way.
>>
>> [ 46.829393] Unable to handle kernel paging request at virtual address
>> f09b2000
>> ...
>> [<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>]
>> (tegra_drm_submit+0x474/0x510)
>> [<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c)
>> [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec)
>> [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4)
>> [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c)
>> [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)
>>
>> Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>> Reviewed-by: Erik Faye-Lund <kusmabite-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>> ---
>> drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
>> drivers/gpu/drm/tegra/gem.c | 5 -----
>> drivers/gpu/drm/tegra/gem.h | 5 +++++
>> 3 files changed, 35 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
>> index 768750226452..c5844a065681 100644
>> --- a/drivers/gpu/drm/tegra/drm.c
>> +++ b/drivers/gpu/drm/tegra/drm.c
>> @@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context
>> *context,
>> while (num_cmdbufs) {
>> struct drm_tegra_cmdbuf cmdbuf;
>> struct host1x_bo *bo;
>> + struct tegra_bo *obj;
>> + u64 offset;
>>
>> if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
>> err = -EFAULT;
>> @@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context
>> *context,
>> goto fail;
>> }
>>
>> + offset = (u64)cmdbuf.offset + (u64)cmdbuf.words *
>> sizeof(u32);
>> + obj = host1x_to_tegra_bo(bo);
>> +
>> + if (offset & 3 || offset > obj->gem.size) {
>> + err = -EINVAL;
>> + goto fail;
>> + }
>> +
>> host1x_job_add_gather(job, bo, cmdbuf.words,
>> cmdbuf.offset);
>> num_cmdbufs--;
>> cmdbufs++;
>> @@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context
>> *context,
>>
>> /* copy and resolve relocations from submit */
>> while (num_relocs--) {
>> + struct host1x_reloc *reloc;
>> + struct tegra_bo *obj;
>> +
>> err =
>> host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
>> &relocs[num_relocs],
>> drm,
>> file);
>> if (err < 0)
>> goto fail;
>> +
>> + reloc = &job->relocarray[num_relocs];
>> + obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
>> +
>> + if (reloc->cmdbuf.offset & 3 ||
>> + reloc->cmdbuf.offset > obj->gem.size) {
>
>
> This could still fail if the bo's size is not divisible by 4, even with >=
> comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the
> same as in the gather case, i.e. find out the address immediately after the
> write and compare using >. Perhaps add a helper function if it makes sense.
> I also don't think the "& 3" checks are needed.
The bo-size is always a multiple of PAGE_SIZE, due to the rounding in
tegra_bo_alloc_object(), so I don't think this actually can fail. But
maybe we want to future-proof this code for a potential future where
this is not the case?
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations
[not found] ` <CABPQNSYgayogP1MCTj5O4UNFrsWr5e5F9e8E0wHMU0bieW+Ocw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
@ 2017-05-16 8:10 ` Mikko Perttunen
[not found] ` <2fa29660-8982-7caa-065c-b04e2fd2a8b6-/1wQRMveznE@public.gmane.org>
0 siblings, 1 reply; 12+ messages in thread
From: Mikko Perttunen @ 2017-05-16 8:10 UTC (permalink / raw)
To: kusmabite-Re5JQEeQqe8AvxtiuMwx3w
Cc: Dmitry Osipenko, Thierry Reding,
linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development
On 16.05.2017 10:32, Erik Faye-Lund wrote:
> On Tue, May 16, 2017 at 8:56 AM, Mikko Perttunen <cyndis-/1wQRMveznE@public.gmane.org> wrote:
>> On 14.05.2017 23:47, Dmitry Osipenko wrote:
>>>
>>> If commands buffer claims a number of words that is higher than its BO can
>>> fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was
>>> triggered by an opentegra Xorg driver that erroneously pushed too many
>>> commands to the pushbuf. The CMDA commands buffer address is 4 bytes
>>> aligned, so check the alignment as well.
>>>
>>> Add a sanity check for the relocations in a same way.
>>>
>>> [ 46.829393] Unable to handle kernel paging request at virtual address
>>> f09b2000
>>> ...
>>> [<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>]
>>> (tegra_drm_submit+0x474/0x510)
>>> [<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c)
>>> [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec)
>>> [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4)
>>> [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c)
>>> [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)
>>>
>>> Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>>> Reviewed-by: Erik Faye-Lund <kusmabite-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>>> ---
>>> drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
>>> drivers/gpu/drm/tegra/gem.c | 5 -----
>>> drivers/gpu/drm/tegra/gem.h | 5 +++++
>>> 3 files changed, 35 insertions(+), 5 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
>>> index 768750226452..c5844a065681 100644
>>> --- a/drivers/gpu/drm/tegra/drm.c
>>> +++ b/drivers/gpu/drm/tegra/drm.c
>>> @@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context
>>> *context,
>>> while (num_cmdbufs) {
>>> struct drm_tegra_cmdbuf cmdbuf;
>>> struct host1x_bo *bo;
>>> + struct tegra_bo *obj;
>>> + u64 offset;
>>>
>>> if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
>>> err = -EFAULT;
>>> @@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context
>>> *context,
>>> goto fail;
>>> }
>>>
>>> + offset = (u64)cmdbuf.offset + (u64)cmdbuf.words *
>>> sizeof(u32);
>>> + obj = host1x_to_tegra_bo(bo);
>>> +
>>> + if (offset & 3 || offset > obj->gem.size) {
>>> + err = -EINVAL;
>>> + goto fail;
>>> + }
>>> +
>>> host1x_job_add_gather(job, bo, cmdbuf.words,
>>> cmdbuf.offset);
>>> num_cmdbufs--;
>>> cmdbufs++;
>>> @@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context
>>> *context,
>>>
>>> /* copy and resolve relocations from submit */
>>> while (num_relocs--) {
>>> + struct host1x_reloc *reloc;
>>> + struct tegra_bo *obj;
>>> +
>>> err =
>>> host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
>>> &relocs[num_relocs],
>>> drm,
>>> file);
>>> if (err < 0)
>>> goto fail;
>>> +
>>> + reloc = &job->relocarray[num_relocs];
>>> + obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
>>> +
>>> + if (reloc->cmdbuf.offset & 3 ||
>>> + reloc->cmdbuf.offset > obj->gem.size) {
>>
>>
>> This could still fail if the bo's size is not divisible by 4, even with >=
>> comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the
>> same as in the gather case, i.e. find out the address immediately after the
>> write and compare using >. Perhaps add a helper function if it makes sense.
>> I also don't think the "& 3" checks are needed.
>
> The bo-size is always a multiple of PAGE_SIZE, due to the rounding in
> tegra_bo_alloc_object(), so I don't think this actually can fail. But
> maybe we want to future-proof this code for a potential future where
> this is not the case?
>
Yeah, I think whether or not this might change in the future, the code
would be easier to understand with the change.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2] drm/tegra: Correct idr_alloc() minimum id
[not found] ` <20170514204734.22130-4-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
@ 2017-05-16 8:11 ` Mikko Perttunen
0 siblings, 0 replies; 12+ messages in thread
From: Mikko Perttunen @ 2017-05-16 8:11 UTC (permalink / raw)
To: Dmitry Osipenko, Thierry Reding
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
Reviewed-by: Mikko Perttunen <mperttunen-DDmLM1+adcrQT0dZR+AlfA@public.gmane.org>
On 14.05.2017 23:47, Dmitry Osipenko wrote:
> The client ID 0 is reserved by the host1x/cdma to mark the timeout timer
> work as already been scheduled and context ID is used as the clients one.
> This fixes spurious CDMA timeouts.
>
> Fixes: bdd2f9cd10eb ("drm/tegra: Don't leak kernel pointer to userspace")
> Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> ---
>
> v2: Changed the commit description, now explains the cause of CDMA timeouts.
>
> drivers/gpu/drm/tegra/drm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
> index c5844a065681..489cb32453f7 100644
> --- a/drivers/gpu/drm/tegra/drm.c
> +++ b/drivers/gpu/drm/tegra/drm.c
> @@ -548,7 +548,7 @@ static int tegra_client_open(struct tegra_drm_file *fpriv,
> if (err < 0)
> return err;
>
> - err = idr_alloc(&fpriv->contexts, context, 0, 0, GFP_KERNEL);
> + err = idr_alloc(&fpriv->contexts, context, 1, 0, GFP_KERNEL);
> if (err < 0) {
> client->ops->close_channel(context);
> return err;
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations
[not found] ` <3db57134-4dba-e886-059c-96034192f637-/1wQRMveznE@public.gmane.org>
2017-05-16 7:32 ` Erik Faye-Lund
@ 2017-05-16 8:11 ` Dmitry Osipenko
1 sibling, 0 replies; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-16 8:11 UTC (permalink / raw)
To: Mikko Perttunen, Thierry Reding
Cc: linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development, Erik Faye-Lund
On 16.05.2017 09:56, Mikko Perttunen wrote:
> On 14.05.2017 23:47, Dmitry Osipenko wrote:
>> + if (reloc->cmdbuf.offset & 3 ||
>> + reloc->cmdbuf.offset > obj->gem.size) {
>
> This could still fail if the bo's size is not divisible by 4, even with >=
> comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the same
> as in the gather case, i.e. find out the address immediately after the write and
> compare using >. Perhaps add a helper function if it makes sense. I also don't
> think the "& 3" checks are needed.
>
Sorry, I forgot to mention the reason of the relocations cmdbuf offset alignment
requirement in the commit description. So the reason is that during the patching
of the gather in do_relocs(), the unaligned offset would cause a partial
overwrite of the command buffer word following the relocation and only a part of
the relocation address being written to the actual address word.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations
[not found] ` <2fa29660-8982-7caa-065c-b04e2fd2a8b6-/1wQRMveznE@public.gmane.org>
@ 2017-05-16 8:56 ` Dmitry Osipenko
0 siblings, 0 replies; 12+ messages in thread
From: Dmitry Osipenko @ 2017-05-16 8:56 UTC (permalink / raw)
To: Mikko Perttunen, kusmabite-Re5JQEeQqe8AvxtiuMwx3w
Cc: Thierry Reding, linux-tegra-u79uwXL29TY76Z2rM5mHXA, DRI Development
On 16.05.2017 11:10, Mikko Perttunen wrote:
>
>
> On 16.05.2017 10:32, Erik Faye-Lund wrote:
>> On Tue, May 16, 2017 at 8:56 AM, Mikko Perttunen <cyndis-/1wQRMveznE@public.gmane.org> wrote:
>>> On 14.05.2017 23:47, Dmitry Osipenko wrote:
>>>>
>>>> If commands buffer claims a number of words that is higher than its BO can
>>>> fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was
>>>> triggered by an opentegra Xorg driver that erroneously pushed too many
>>>> commands to the pushbuf. The CMDA commands buffer address is 4 bytes
>>>> aligned, so check the alignment as well.
>>>>
>>>> Add a sanity check for the relocations in a same way.
>>>>
>>>> [ 46.829393] Unable to handle kernel paging request at virtual address
>>>> f09b2000
>>>> ...
>>>> [<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>]
>>>> (tegra_drm_submit+0x474/0x510)
>>>> [<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c)
>>>> [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec)
>>>> [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4)
>>>> [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c)
>>>> [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)
>>>>
>>>> Signed-off-by: Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>>>> Reviewed-by: Erik Faye-Lund <kusmabite-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>>>> ---
>>>> drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
>>>> drivers/gpu/drm/tegra/gem.c | 5 -----
>>>> drivers/gpu/drm/tegra/gem.h | 5 +++++
>>>> 3 files changed, 35 insertions(+), 5 deletions(-)
>>>>
>>>> diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
>>>> index 768750226452..c5844a065681 100644
>>>> --- a/drivers/gpu/drm/tegra/drm.c
>>>> +++ b/drivers/gpu/drm/tegra/drm.c
>>>> @@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context
>>>> *context,
>>>> while (num_cmdbufs) {
>>>> struct drm_tegra_cmdbuf cmdbuf;
>>>> struct host1x_bo *bo;
>>>> + struct tegra_bo *obj;
>>>> + u64 offset;
>>>>
>>>> if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
>>>> err = -EFAULT;
>>>> @@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context
>>>> *context,
>>>> goto fail;
>>>> }
>>>>
>>>> + offset = (u64)cmdbuf.offset + (u64)cmdbuf.words *
>>>> sizeof(u32);
>>>> + obj = host1x_to_tegra_bo(bo);
>>>> +
>>>> + if (offset & 3 || offset > obj->gem.size) {
>>>> + err = -EINVAL;
>>>> + goto fail;
>>>> + }
>>>> +
>>>> host1x_job_add_gather(job, bo, cmdbuf.words,
>>>> cmdbuf.offset);
>>>> num_cmdbufs--;
>>>> cmdbufs++;
>>>> @@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context
>>>> *context,
>>>>
>>>> /* copy and resolve relocations from submit */
>>>> while (num_relocs--) {
>>>> + struct host1x_reloc *reloc;
>>>> + struct tegra_bo *obj;
>>>> +
>>>> err =
>>>> host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
>>>> &relocs[num_relocs],
>>>> drm,
>>>> file);
>>>> if (err < 0)
>>>> goto fail;
>>>> +
>>>> + reloc = &job->relocarray[num_relocs];
>>>> + obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
>>>> +
>>>> + if (reloc->cmdbuf.offset & 3 ||
>>>> + reloc->cmdbuf.offset > obj->gem.size) {
>>>
>>>
>>> This could still fail if the bo's size is not divisible by 4, even with >=
>>> comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the
>>> same as in the gather case, i.e. find out the address immediately after the
>>> write and compare using >. Perhaps add a helper function if it makes sense.
>>> I also don't think the "& 3" checks are needed.
>>
>> The bo-size is always a multiple of PAGE_SIZE, due to the rounding in
>> tegra_bo_alloc_object(), so I don't think this actually can fail. But
>> maybe we want to future-proof this code for a potential future where
>> this is not the case?
>>
>
> Yeah, I think whether or not this might change in the future, the code would be
> easier to understand with the change.
It's very unlikely to me that BO size round-upping may go away. I'll add a
comment for that alignment check to make it clear in the code.
--
Dmitry
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2017-05-16 8:56 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-14 20:47 [PATCH] gpu: host1x: Do not leak BO's phys address to userspace Dmitry Osipenko
[not found] ` <20170514204734.22130-1-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-14 20:47 ` [PATCH] drm/tegra: Check whether page belongs to BO in tegra_bo_kmap() Dmitry Osipenko
[not found] ` <20170514204734.22130-2-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-15 7:54 ` Dmitry Osipenko
2017-05-14 20:47 ` [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations Dmitry Osipenko
[not found] ` <20170514204734.22130-3-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-15 8:01 ` Dmitry Osipenko
2017-05-16 6:56 ` Mikko Perttunen
[not found] ` <3db57134-4dba-e886-059c-96034192f637-/1wQRMveznE@public.gmane.org>
2017-05-16 7:32 ` Erik Faye-Lund
[not found] ` <CABPQNSYgayogP1MCTj5O4UNFrsWr5e5F9e8E0wHMU0bieW+Ocw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-05-16 8:10 ` Mikko Perttunen
[not found] ` <2fa29660-8982-7caa-065c-b04e2fd2a8b6-/1wQRMveznE@public.gmane.org>
2017-05-16 8:56 ` Dmitry Osipenko
2017-05-16 8:11 ` Dmitry Osipenko
2017-05-14 20:47 ` [PATCH v2] drm/tegra: Correct idr_alloc() minimum id Dmitry Osipenko
[not found] ` <20170514204734.22130-4-digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-05-16 8:11 ` Mikko Perttunen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.