linux-kernel - [PATCH] drm: sanitize ttm_device_funcs.evict

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250702052421.80423-1-linma@zju.edu.cn>
Date: Wed,  2 Jul 2025 13:24:21 +0800
From: Lin Ma <linma@....edu.cn>
To: davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	horms@...nel.org,
	linma@....edu.cn,
	mingo@...nel.org,
	tglx@...utronix.de,
	pwn9uin@...il.com,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] drm: sanitize ttm_device_funcs.evict_flags/move casting

Our analysis revealed that most handlers in ttm_device_funcs perform
type checks before invoking container_of on ttm_buffer_object.

For instance, commit d03d858970a1 ("drm/radeon/kms: Check if bo we got
from ttm are radeon object or not") introduced an object type check (
based on the comparison with destroy function).

This commit adds the missing type checks in the nouveau_bo_evict_flags
and bo_driver_move handlers.

Signed-off-by: Lin Ma <linma@....edu.cn>
---
 drivers/gpu/drm/drm_gem_vram_helper.c | 3 +++
 drivers/gpu/drm/nouveau/nouveau_bo.c  | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c
index 22b1fe9c03b8..40d1b584327e 100644
--- a/drivers/gpu/drm/drm_gem_vram_helper.c
+++ b/drivers/gpu/drm/drm_gem_vram_helper.c
@@ -855,6 +855,9 @@ static int bo_driver_move(struct ttm_buffer_object *bo,
 		return 0;
 	}
 
+	if (!drm_is_gem_vram(bo))
+		return -EINVAL;
+
 	gbo = drm_gem_vram_of_bo(bo);
 
 	return drm_gem_vram_bo_driver_move(gbo, evict, ctx, new_mem);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index b96f0555ca14..81a66246d547 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -887,6 +887,9 @@ nouveau_bo_evict_flags(struct ttm_buffer_object *bo, struct ttm_placement *pl)
 {
 	struct nouveau_bo *nvbo = nouveau_bo(bo);
 
+	if (bo->destroy != nouveau_bo_del_ttm)
+		return;
+
 	switch (bo->resource->mem_type) {
 	case TTM_PL_VRAM:
 		nouveau_bo_placement_set(nvbo, NOUVEAU_GEM_DOMAIN_GART,
-- 
2.17.1