linux-kernel - nouveau: check client.base.vm before dereferencing it.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 30 Jul 2013 18:55:21 -0400
From:	Dave Jones <davej@...hat.com>
To:	Linux Kernel <linux-kernel@...r.kernel.org>, bskeggs@...hat.com
Cc:	maarten.lankhorst@...onical.com
Subject: nouveau: check client.base.vm before dereferencing it.

On Thu, Jul 25, 2013 at 12:22:03PM -0400, Dave Jones wrote:
 > This recently started happening (since the last DRM merge, 3.10 was fine).
 > 
 > [   17.751970] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
 > [   17.753911] CPU: 3 PID: 292 Comm: systemd-udevd Not tainted 3.11.0-rc2+ #13 
 > [   17.754392] EIP: 0060:[<f86dde0f>] EFLAGS: 00010296 CPU: 3
 > [   17.754542] EIP is at nouveau_bo_new+0x1f/0x28c [nouveau]
 > [   17.754647] EAX: 00000000 EBX: ed8610b0 ECX: 00000100 EDX: 00004000
 > ..
 > [   17.756729] Call Trace:
 > [   17.756849]  [<f850280f>] ? drm_mode_crtc_set_gamma_size+0x23/0x43 [drm]
 > [   17.756993]  [<f86ef2f6>] nv04_crtc_create+0xd4/0x142 [nouveau]
 > [   17.757138]  [<f86f2758>] nv04_display_create+0xf2/0x35a [nouveau]
 > [   17.757281]  [<f86e801a>] nouveau_display_create+0x33f/0x553 [nouveau]
 > [   17.757422]  [<f86d99fb>] nouveau_drm_load+0x22f/0x5dc [nouveau]
 > [   17.757534]  [<c1391816>] ? device_register+0x17/0x1a
 > [   17.757648]  [<f84ff77b>] ? drm_sysfs_device_add+0x76/0xa3 [drm]
 > [   17.757764]  [<f84fe6bd>] drm_get_pci_dev+0x138/0x238 [drm]
 > [   17.757902]  [<f86ab3ce>] ? nouveau_device_create_+0x65/0x11b [nouveau]
 > [   17.758044]  [<f86da081>] nouveau_drm_probe+0x2d9/0x360 [nouveau]
 > [   17.758155]  [<c12d55ac>] pci_device_probe+0x6c/0xb0
 > [   17.758261]  [<c1393dae>] driver_probe_device+0x7f/0x356
 > [   17.758367]  [<c139412c>] __driver_attach+0x74/0x76
 > [   17.758473]  [<c13940b8>] ? __device_attach+0x33/0x33
 > [   17.758579]  [<c13922b6>] bus_for_each_dev+0x49/0x74
 > [   17.758684]  [<c13938ec>] driver_attach+0x1e/0x20
 > [   17.758791]  [<c13940b8>] ? __device_attach+0x33/0x33
 > [   17.758896]  [<c1393550>] bus_add_driver+0x1d0/0x27c
 > [   17.759002]  [<c12d51c2>] ? pci_pm_suspend+0x111/0x111
 > [   17.759109]  [<c12d51c2>] ? pci_pm_suspend+0x111/0x111
 > [   17.759215]  [<c1394667>] driver_register+0x6a/0x123
 > [   17.759321]  [<c12bdfad>] ? __raw_spin_lock_init+0x2d/0x4e
 > [   17.759428]  [<c12d45f3>] __pci_register_driver+0x4a/0x4d
 > [   17.760008]  [<f84fe8a3>] drm_pci_init+0xe6/0xee [drm]
 > [   17.760008]  [<f8752000>] ? 0xf8751fff
 > [   17.760008]  [<f8752048>] nouveau_drm_init+0x48/0x1000 [nouveau]
 > [   17.760008]  [<c10003f0>] do_one_initcall+0xc0/0x180
 > [   17.760008]  [<f8752000>] ? 0xf8751fff
 > [   17.760008]  [<c1033765>] ? set_memory_nx+0x5a/0x5c
 > [   17.760008]  [<c15aca75>] ? set_section_ro_nx+0x54/0x59
 > [   17.760008]  [<c10b4174>] load_module+0x1ad6/0x2519
 > [   17.760008]  [<c10b05ed>] ? copy_module_from_fd.isra.49+0x34/0x13b
 > [   17.760008]  [<c10b4d0b>] SyS_finit_module+0x73/0xac
 > [   17.760008]  [<c106b0cb>] ? up_write+0x1b/0x30
 > [   17.760008]  [<c11343ca>] ? vm_mmap_pgoff+0x7a/0x97
 > [   17.760008]  [<c15bf03b>] sysenter_do_call+0x12/0x32
 > [   17.760008] Code: c7 83 1c 01 00 00 ff ff ff ff eb aa 55 89 e5 57 56 53 83 ec 2c 66 66 66 66 90 89 d6 89 4d e8 8b b8 ec 03 00 00 8b 87 8c 00 00 00 <8b> 00 0f b6 88 91 00 00 00 b8 ff ff ff ff d3 e0 25 ff ff ff 7f

0108bc808107b97e101b15af9705729626be6447 introduced an oops due
to use doing a dereference on a variable that can validly be null.
    
Split up the new check, and add an additional check before
the potential NULL dereference.
    
Signed-off-by: Dave Jones <davej@...hat.com>

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 9b2c939..6c1ba6b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -198,13 +198,22 @@ nouveau_bo_new(struct drm_device *dev, int size, int align,
 	size_t acc_size;
 	int ret;
 	int type = ttm_bo_type_device;
-	int max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1);
+	int max_size;
 
-	if (size <= 0 || size > max_size) {
+	if (size <= 0) {
 		nv_warn(drm, "skipped size %x\n", (u32)size);
 		return -EINVAL;
 	}
 
+	if (drm->client.base.vm) {
+		max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1);
+
+		if (size > max_size) {
+			nv_warn(drm, "skipped size %x\n", (u32)size);
+			return -EINVAL;
+		}
+	}
+
 	if (sg)
 		type = ttm_bo_type_sg;
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/