Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4da6b08 authored by xinhui pan's avatar xinhui pan Committed by Greg Kroah-Hartman
Browse files

drm/amdgpu: validate the parameters of bo mapping operations more clearly 



[ Upstream commit 6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75 ]

Verify the parameters of
amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.

Fixes: dc54d3d1 ("drm/amdgpu: implement AMDGPU_VA_OP_CLEAR v2")
Cc: stable@vger.kernel.org
Reported-by: default avatarVlad Stolyarov <hexed@google.com>
Suggested-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarxinhui pan <xinhui.pan@amd.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 82aace80

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c

+46 −26
Original line number Diff line number Diff line
@@ -2048,6 +2048,37 @@ static void amdgpu_vm_bo_insert_map(struct amdgpu_device *adev, 
	trace_amdgpu_vm_bo_map(bo_va, mapping);

}



/* Validate operation parameters to prevent potential abuse */

static int amdgpu_vm_verify_parameters(struct amdgpu_device *adev,

					  struct amdgpu_bo *bo,

					  uint64_t saddr,

					  uint64_t offset,

					  uint64_t size)

{

	uint64_t tmp, lpfn;



	if (saddr & AMDGPU_GPU_PAGE_MASK

	    || offset & AMDGPU_GPU_PAGE_MASK

	    || size & AMDGPU_GPU_PAGE_MASK)

		return -EINVAL;



	if (check_add_overflow(saddr, size, &tmp)

	    || check_add_overflow(offset, size, &tmp)

	    || size == 0 /* which also leads to end < begin */)

		return -EINVAL;



	/* make sure object fit at this offset */

	if (bo && offset + size > amdgpu_bo_size(bo))

		return -EINVAL;



	/* Ensure last pfn not exceed max_pfn */

	lpfn = (saddr + size - 1) >> AMDGPU_GPU_PAGE_SHIFT;

	if (lpfn >= adev->vm_manager.max_pfn)

		return -EINVAL;



	return 0;

}



/**

 * amdgpu_vm_bo_map - map bo inside a vm

 *
@@ -2074,21 +2105,14 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev, 
	struct amdgpu_bo *bo = bo_va->base.bo;

	struct amdgpu_vm *vm = bo_va->base.vm;

	uint64_t eaddr;

	int r;



	/* validate the parameters */

	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)

		return -EINVAL;

	if (saddr + size <= saddr || offset + size <= offset)

		return -EINVAL;



	/* make sure object fit at this offset */

	eaddr = saddr + size - 1;

	if ((bo && offset + size > amdgpu_bo_size(bo)) ||

	    (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))

		return -EINVAL;

	r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size);

	if (r)

		return r;



	saddr /= AMDGPU_GPU_PAGE_SIZE;

	eaddr /= AMDGPU_GPU_PAGE_SIZE;

	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;



	tmp = amdgpu_vm_it_iter_first(&vm->va, saddr, eaddr);

	if (tmp) {
@@ -2141,17 +2165,9 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, 
	uint64_t eaddr;

	int r;



	/* validate the parameters */

	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK || size & ~PAGE_MASK)

		return -EINVAL;

	if (saddr + size <= saddr || offset + size <= offset)

		return -EINVAL;



	/* make sure object fit at this offset */

	eaddr = saddr + size - 1;

	if ((bo && offset + size > amdgpu_bo_size(bo)) ||

	    (eaddr >= adev->vm_manager.max_pfn << AMDGPU_GPU_PAGE_SHIFT))

		return -EINVAL;

	r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size);

	if (r)

		return r;



	/* Allocate all the needed memory */

	mapping = kmalloc(sizeof(*mapping), GFP_KERNEL);
@@ -2165,7 +2181,7 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, 
	}



	saddr /= AMDGPU_GPU_PAGE_SIZE;

	eaddr /= AMDGPU_GPU_PAGE_SIZE;

	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;



	mapping->start = saddr;

	mapping->last = eaddr;
@@ -2252,10 +2268,14 @@ int amdgpu_vm_bo_clear_mappings(struct amdgpu_device *adev, 
	struct amdgpu_bo_va_mapping *before, *after, *tmp, *next;

	LIST_HEAD(removed);

	uint64_t eaddr;

	int r;



	r = amdgpu_vm_verify_parameters(adev, NULL, saddr, 0, size);

	if (r)

		return r;



	eaddr = saddr + size - 1;

	saddr /= AMDGPU_GPU_PAGE_SIZE;

	eaddr /= AMDGPU_GPU_PAGE_SIZE;

	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;



	/* Allocate all the needed memory */

	before = kzalloc(sizeof(*before), GFP_KERNEL);