Quite understandably, we bug out when asked to find a page that doesn't belong to the object. However, we should report the error back to the user long before we attempt the out-of-bound access! In this case, it is insufficient validation on the rotated vma, with the simplest/cheapest point for us to insert a bound check when we are computing the rotated page lookups.
Similarly, it might be wise to see if we can validate the user input upon creating the rotated framebuffer. v2: Skip empty planes Closes: https://gitlab.freedesktop.org/drm/intel/issues/951 Signed-off-by: Chris Wilson <ch...@chris-wilson.co.uk> Cc: Ville Syrjälä <ville.syrj...@linux.intel.com> Cc: Matthew Auld <matthew.a...@intel.com --- drivers/gpu/drm/i915/gt/intel_ggtt.c | 25 +++++++++++++++++++---- drivers/gpu/drm/i915/selftests/i915_vma.c | 1 + 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt.c b/drivers/gpu/drm/i915/gt/intel_ggtt.c index 79096722ce16..4a646d74327a 100644 --- a/drivers/gpu/drm/i915/gt/intel_ggtt.c +++ b/drivers/gpu/drm/i915/gt/intel_ggtt.c @@ -1266,6 +1266,7 @@ static noinline struct sg_table * intel_rotate_pages(struct intel_rotation_info *rot_info, struct drm_i915_gem_object *obj) { + const unsigned long npages = obj->base.size >> PAGE_SHIFT; unsigned int size = intel_rotation_info_size(rot_info); struct sg_table *st; struct scatterlist *sg; @@ -1285,9 +1286,26 @@ intel_rotate_pages(struct intel_rotation_info *rot_info, sg = st->sgl; for (i = 0 ; i < ARRAY_SIZE(rot_info->plane); i++) { - sg = rotate_pages(obj, rot_info->plane[i].offset, - rot_info->plane[i].width, rot_info->plane[i].height, - rot_info->plane[i].stride, st, sg); + const struct intel_remapped_plane_info *plane = + &rot_info->plane[i]; + unsigned long last; + + if (!plane->height || !plane->width) + continue; + + last = plane->offset; + last += (plane->height - 1) * plane->stride; + last += plane->width - 1; + if (last >= npages) { + ret = -EINVAL; + goto err_sg_alloc; + } + + sg = rotate_pages(obj, + plane->offset, + plane->width, plane->height, + plane->stride, + st, sg); } return st; @@ -1295,7 +1313,6 @@ intel_rotate_pages(struct intel_rotation_info *rot_info, err_sg_alloc: kfree(st); err_st_alloc: - DRM_DEBUG_DRIVER("Failed to create rotated mapping for object size %zu! (%ux%u tiles, %u pages)\n", obj->base.size, rot_info->plane[0].width, rot_info->plane[0].height, size); diff --git a/drivers/gpu/drm/i915/selftests/i915_vma.c b/drivers/gpu/drm/i915/selftests/i915_vma.c index 58b5f40a07dd..24e7806867ef 100644 --- a/drivers/gpu/drm/i915/selftests/i915_vma.c +++ b/drivers/gpu/drm/i915/selftests/i915_vma.c @@ -962,6 +962,7 @@ static int igt_vma_remapped_gtt(void *arg) *t == I915_GGTT_VIEW_ROTATED ? "Rotated" : "Remapped", val, exp); i915_vma_unpin_iomap(vma); + err = -EINVAL; goto out; } } -- 2.25.0.rc2 _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx
