linux-kernel - Re: [PATCH v2 2/2] drm/amd: validate user GEM object size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 23 Dec 2018 15:46:55 +0800
From:   kbuild test robot <lkp@...el.com>
To:     Yu Zhao <yuzhao@...gle.com>
Cc:     kbuild-all@...org, David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Christian König <christian.koenig@....com>,
        Alex Deucher <alexander.deucher@....com>,
        David Zhou <David1.Zhou@....com>,
        Samuel Li <Samuel.Li@....com>,
        Harry Wentland <harry.wentland@....com>,
        Junwei Zhang <Jerry.Zhang@....com>,
        Daniel Stone <daniels@...labora.com>,
        Joerg Roedel <joro@...tes.org>, amd-gfx@...ts.freedesktop.org,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        Yu Zhao <yuzhao@...gle.com>
Subject: Re: [PATCH v2 2/2] drm/amd: validate user GEM object size

Hi Yu,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on linus/master]
[also build test WARNING on v4.20-rc7 next-20181221]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Yu-Zhao/drm-amd-validate-user-pitch-alignment/20181222-153630
config: i386-randconfig-h1-12231406 (attached as .config)
compiler: gcc-4.9 (Debian 4.9.4-2) 4.9.4
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All warnings (new ones prefixed by >>):

   drivers/gpu//drm/amd/amdgpu/amdgpu_display.c: In function 'amdgpu_display_user_framebuffer_create':
>> drivers/gpu//drm/amd/amdgpu/amdgpu_display.c:556:3: warning: format '%ld' expects argument of type 'long int', but argument 4 has type 'size_t' [-Wformat=]
      DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %ld\n",
      ^

vim +556 drivers/gpu//drm/amd/amdgpu/amdgpu_display.c

   521	
   522	struct drm_framebuffer *
   523	amdgpu_display_user_framebuffer_create(struct drm_device *dev,
   524					       struct drm_file *file_priv,
   525					       const struct drm_mode_fb_cmd2 *mode_cmd)
   526	{
   527		struct drm_gem_object *obj;
   528		struct amdgpu_framebuffer *amdgpu_fb;
   529		int ret;
   530		int height;
   531		struct amdgpu_device *adev = dev->dev_private;
   532		int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
   533		int pitch = amdgpu_align_pitch(adev, mode_cmd->pitches[0], cpp, false);
   534	
   535		if (mode_cmd->pitches[0] != pitch) {
   536			DRM_DEBUG_KMS("Invalid pitch: expecting %d but got %d\n",
   537				      pitch, mode_cmd->pitches[0]);
   538			return ERR_PTR(-EINVAL);
   539		}
   540	
   541		obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
   542		if (obj ==  NULL) {
   543			dev_err(&dev->pdev->dev, "No GEM object associated to handle 0x%08X, "
   544				"can't create framebuffer\n", mode_cmd->handles[0]);
   545			return ERR_PTR(-ENOENT);
   546		}
   547	
   548		/* Handle is imported dma-buf, so cannot be migrated to VRAM for scanout */
   549		if (obj->import_attach) {
   550			DRM_DEBUG_KMS("Cannot create framebuffer from imported dma_buf\n");
   551			return ERR_PTR(-EINVAL);
   552		}
   553	
   554		height = ALIGN(mode_cmd->height, 8);
   555		if (obj->size < pitch * height) {
 > 556			DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %ld\n",
   557				      pitch * height, obj->size);
   558			return ERR_PTR(-EINVAL);
   559		}
   560	
   561		amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
   562		if (amdgpu_fb == NULL) {
   563			drm_gem_object_put_unlocked(obj);
   564			return ERR_PTR(-ENOMEM);
   565		}
   566	
   567		ret = amdgpu_display_framebuffer_init(dev, amdgpu_fb, mode_cmd, obj);
   568		if (ret) {
   569			kfree(amdgpu_fb);
   570			drm_gem_object_put_unlocked(obj);
   571			return ERR_PTR(ret);
   572		}
   573	
   574		return &amdgpu_fb->base;
   575	}
   576	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

Download attachment ".config.gz" of type "application/gzip" (30056 bytes)