Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae3250b4 authored by Mohammed Mirza Mandayappurath Manzoor's avatar Mohammed Mirza Mandayappurath Manzoor Committed by Sumangala P
Browse files

msm: kgsl: Prevent wrap around during user address mapping 



When setting svm region during the gpuobj import ioctl call for a usermem
address, there is a possibility of a very large input size causing the
region's 64-bit end address to wrap around. This can cause the region
to incorrectly be considered valid, ultimately allowing a use after free
scenario. To prevent this, detect the occurrence of a wrap and reject the
import.

Change-Id: I4a88f56c58b830d4342e47dc1d1f6290c78ab6b4
Signed-off-by: default avatarMohammed Mirza Mandayappurath Manzoor <quic_mmandaya@quicinc.com>
Signed-off-by: default avatarPuranam V G Tejaswi <quic_pvgtejas@quicinc.com>
parent db09abd6

drivers/gpu/msm/kgsl_iommu.c

+9 −5
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/compat.h>
@@ -2428,14 +2428,18 @@ static uint64_t kgsl_iommu_find_svm_region(struct kgsl_pagetable *pagetable, 
static bool iommu_addr_in_svm_ranges(struct kgsl_iommu_pt *pt,

	u64 gpuaddr, u64 size)

{

	u64 end = gpuaddr + size;



	/* Make sure size is not zero and we don't wrap around */

	if (end <= gpuaddr)

		return false;



	if ((gpuaddr >= pt->compat_va_start && gpuaddr < pt->compat_va_end) &&

		((gpuaddr + size) > pt->compat_va_start &&

			(gpuaddr + size) <= pt->compat_va_end))

		(end > pt->compat_va_start && end <= pt->compat_va_end))

		return true;



	if ((gpuaddr >= pt->svm_start && gpuaddr < pt->svm_end) &&

		((gpuaddr + size) > pt->svm_start &&

			(gpuaddr + size) <= pt->svm_end))

		(end > pt->svm_start && end <= pt->svm_end))

		return true;



	return false;