Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 86a53e36 authored by Rob Clark's avatar Rob Clark Committed by Sasha Levin
Browse files

drm/msm: fix use of copy_from_user() while holding spinlock 



[ Upstream commit 89f82cbb0d5c0ab768c8d02914188aa2211cd2e3 ]

Use instead __copy_from_user_inatomic() and fallback to slow-path where
we drop and re-aquire the lock in case of fault.

Cc: stable@vger.kernel.org
Reported-by: default avatarVaishali Thakkar <vaishali.thakkar@oracle.com>
Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent 077ae72a

drivers/gpu/drm/msm/msm_gem_submit.c

+22 −5
Original line number Diff line number Diff line
@@ -55,6 +55,14 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev, 
	return submit;

}



static inline unsigned long __must_check

copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)

{

	if (access_ok(VERIFY_READ, from, n))

		return __copy_from_user_inatomic(to, from, n);

	return -EFAULT;

}



static int submit_lookup_objects(struct msm_gem_submit *submit,

		struct drm_msm_gem_submit *args, struct drm_file *file)

{
@@ -62,6 +70,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, 
	int ret = 0;



	spin_lock(&file->table_lock);

	pagefault_disable();



	for (i = 0; i < args->nr_bos; i++) {

		struct drm_msm_gem_submit_bo submit_bo;
@@ -70,10 +79,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, 
		void __user *userptr =

			to_user_ptr(args->bos + (i * sizeof(submit_bo)));



		ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));

		if (unlikely(ret)) {

			pagefault_enable();

			spin_unlock(&file->table_lock);

			ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));

		if (ret) {

			ret = -EFAULT;

			goto out_unlock;

			if (ret)

				goto out;

			spin_lock(&file->table_lock);

			pagefault_disable();

		}



		if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@@ -113,9 +127,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, 
	}



out_unlock:

	submit->nr_bos = i;

	pagefault_enable();

	spin_unlock(&file->table_lock);



out:

	submit->nr_bos = i;



	return ret;

}