linux-kernel - Re: [PATCH] drm/msm: Fix MSM_INFO_GET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAF6AEGt868msEPdZwJTB3YQppwNLaavSsDm1mGznCu1jsSPxCQ@mail.gmail.com>
Date:   Thu, 7 Jan 2021 09:20:29 -0800
From:   Rob Clark <robdclark@...il.com>
To:     Iskren Chernev <iskren.chernev@...il.com>
Cc:     ~postmarketos/upstreaming@...ts.sr.ht, Sean Paul <sean@...rly.run>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Jordan Crouse <jcrouse@...eaurora.org>,
        linux-arm-msm <linux-arm-msm@...r.kernel.org>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        freedreno <freedreno@...ts.freedesktop.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/msm: Fix MSM_INFO_GET_IOVA with carveout

On Sat, Jan 2, 2021 at 12:26 PM Iskren Chernev <iskren.chernev@...il.com> wrote:
>
> The msm_gem_get_iova should be guarded with gpu != NULL and not aspace
> != NULL, because aspace is NULL when using vram carveout.
>
> Fixes: 933415e24bd0d ("drm/msm: Add support for private address space instances")
>
> Signed-off-by: Iskren Chernev <iskren.chernev@...il.com>
> ---
>  drivers/gpu/drm/msm/msm_drv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
> index c5e61cb3356df..c1953fb079133 100644
> --- a/drivers/gpu/drm/msm/msm_drv.c
> +++ b/drivers/gpu/drm/msm/msm_drv.c
> @@ -775,9 +775,10 @@ static int msm_ioctl_gem_info_iova(struct drm_device *dev,
>                 struct drm_file *file, struct drm_gem_object *obj,
>                 uint64_t *iova)
>  {
> +       struct msm_drm_private *priv = dev->dev_private;
>         struct msm_file_private *ctx = file->driver_priv;
>
> -       if (!ctx->aspace)
> +       if (!priv->gpu)
>                 return -EINVAL;

Does this actually work?  It seems like you would hit a null ptr deref
in msm_gem_init_vma().. and in general I think a lot of code paths
would be surprised by a null address space, so this seems like a risky
idea.

Maybe instead we should be creating an address space for the vram carveout?

BR,
-R


>         /*
> --
> 2.29.2
>