Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4694257e authored by Evan Quan's avatar Evan Quan Committed by Alex Deucher
Browse files

drm/amdgpu/psp: prevent page fault by checking write_frame address(v4) 



 - Prevent a possible buffer overflow when updating the ring buffer by
    bounds checking the command frame against the available space in the
    ring buffer.

 v2: update the ring_buffer_end address
 v3: update the commit log
 v4: squash in print fix (Michel)

Signed-off-by: default avatarEvan Quan <evan.quan@amd.com>
Reviewed-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 0722382d

drivers/gpu/drm/amd/amdgpu/psp_v10_0.c

+12 −2
Original line number Diff line number Diff line
@@ -257,6 +257,9 @@ int psp_v10_0_cmd_submit(struct psp_context *psp, 
	unsigned int psp_write_ptr_reg = 0;

	struct psp_gfx_rb_frame * write_frame = psp->km_ring.ring_mem;

	struct psp_ring *ring = &psp->km_ring;

	struct psp_gfx_rb_frame *ring_buffer_start = ring->ring_mem;

	struct psp_gfx_rb_frame *ring_buffer_end = ring_buffer_start +

		ring->ring_size / sizeof(struct psp_gfx_rb_frame) - 1;

	struct amdgpu_device *adev = psp->adev;

	uint32_t ring_size_dw = ring->ring_size / 4;

	uint32_t rb_frame_size_dw = sizeof(struct psp_gfx_rb_frame) / 4;
@@ -266,9 +269,16 @@ int psp_v10_0_cmd_submit(struct psp_context *psp, 


	/* Update KM RB frame pointer to new frame */

	if ((psp_write_ptr_reg % ring_size_dw) == 0)

		write_frame = ring->ring_mem;

		write_frame = ring_buffer_start;

	else

		write_frame = ring->ring_mem + (psp_write_ptr_reg / rb_frame_size_dw);

		write_frame = ring_buffer_start + (psp_write_ptr_reg / rb_frame_size_dw);

	/* Check invalid write_frame ptr address */

	if ((write_frame < ring_buffer_start) || (ring_buffer_end < write_frame)) {

		DRM_ERROR("ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n",

			  ring_buffer_start, ring_buffer_end, write_frame);

		DRM_ERROR("write_frame is pointing to address out of bounds\n");

		return -EINVAL;

	}



	/* Initialize KM RB frame */

	memset(write_frame, 0, sizeof(struct psp_gfx_rb_frame));

drivers/gpu/drm/amd/amdgpu/psp_v3_1.c

+12 −2
Original line number Diff line number Diff line
@@ -367,6 +367,9 @@ int psp_v3_1_cmd_submit(struct psp_context *psp, 
	unsigned int psp_write_ptr_reg = 0;

	struct psp_gfx_rb_frame * write_frame = psp->km_ring.ring_mem;

	struct psp_ring *ring = &psp->km_ring;

	struct psp_gfx_rb_frame *ring_buffer_start = ring->ring_mem;

	struct psp_gfx_rb_frame *ring_buffer_end = ring_buffer_start +

		ring->ring_size / sizeof(struct psp_gfx_rb_frame) - 1;

	struct amdgpu_device *adev = psp->adev;

	uint32_t ring_size_dw = ring->ring_size / 4;

	uint32_t rb_frame_size_dw = sizeof(struct psp_gfx_rb_frame) / 4;
@@ -378,9 +381,16 @@ int psp_v3_1_cmd_submit(struct psp_context *psp, 
	/* write_frame ptr increments by size of rb_frame in bytes */

	/* psp_write_ptr_reg increments by size of rb_frame in DWORDs */

	if ((psp_write_ptr_reg % ring_size_dw) == 0)

		write_frame = ring->ring_mem;

		write_frame = ring_buffer_start;

	else

		write_frame = ring->ring_mem + (psp_write_ptr_reg / rb_frame_size_dw);

		write_frame = ring_buffer_start + (psp_write_ptr_reg / rb_frame_size_dw);

	/* Check invalid write_frame ptr address */

	if ((write_frame < ring_buffer_start) || (ring_buffer_end < write_frame)) {

		DRM_ERROR("ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n",

			  ring_buffer_start, ring_buffer_end, write_frame);

		DRM_ERROR("write_frame is pointing to address out of bounds\n");

		return -EINVAL;

	}



	/* Initialize KM RB frame */

	memset(write_frame, 0, sizeof(struct psp_gfx_rb_frame));