gpu: host1x: Do not leak BO's phys address to userspace

This fixes an OOPS in case of out-of-bounds accessing of a kmap'ed commands buffer CMA while patching relocations in do_relocs().

Signed-off-by Dmitry Osipenko <[email protected]>

---
 drivers/gpu/drm/tegra/gem.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/gpu/drm/tegra/gem.c +0 -0

index 424569b53e57..b76d7ac75696 100644

drivers/gpu/drm/tegra/drm.c +11 -0

 	/* copy and resolve relocations from submit */
 	while (num_relocs--) {
+		struct host1x_reloc *reloc;
+		struct tegra_bo *obj;
+
 		err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
 						  &relocs[num_relocs], drm,
 						  file);
 		if (err < 0)
 			goto fail;
+
+		reloc = &job->relocarray[num_relocs];
+		obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
+
+		if (reloc->cmdbuf.offset & 3 ||
+		    reloc->cmdbuf.offset > obj->gem.size) {
+			err = -EINVAL;
+			goto fail;

If commands buffer claims a number of words that is higher than its BO can fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. The CMDA commands buffer address is 4 bytes aligned, so check the alignment as well.

Add a sanity check for the relocations in a same way.

[   46.829393] Unable to handle kernel paging request at virtual address f09b2000

...
[<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510) [<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c) [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec) [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4) [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c) [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)

Signed-off-by Dmitry Osipenko <[email protected]>

Reviewed-by Erik Faye-Lund <[email protected]>

---
 drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
 drivers/gpu/drm/tegra/gem.c |  5 -----
 drivers/gpu/drm/tegra/gem.h |  5 +++++
 3 files changed, 35 insertions(+), 5 deletions(-)

drivers/gpu/drm/tegra/drm.c +13 -0

index 768750226452..c5844a065681 100644
@@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context *context,
 	while (num_cmdbufs) {
 		struct drm_tegra_cmdbuf cmdbuf;
 		struct host1x_bo *bo;
+		struct tegra_bo *obj;
+		u64 offset;
 
 		if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {
 			err = -EFAULT;

@@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context *context,
 			goto fail;
 		}
 
+		offset = (u64)cmdbuf.offset + (u64)cmdbuf.words * sizeof(u32);
+		obj = host1x_to_tegra_bo(bo);
+
+		if (offset & 3 || offset > obj->gem.size) {
+			err = -EINVAL;
+			goto fail;
+		}
+
 		host1x_job_add_gather(job, bo, cmdbuf.words, cmdbuf.offset);
 		num_cmdbufs--;
 		cmdbufs++;

@@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context *context,
 
 	/* copy and resolve relocations from submit */
 	while (num_relocs--) {
+		struct host1x_reloc *reloc;
+		struct tegra_bo *obj;
+
 		err = host1x_reloc_copy_from_user(&job->relocarray[num_relocs],

drivers/gpu/drm/tegra/drm.c +11 -0

+			err = -EINVAL;
+			goto fail;
+		}
+
+		obj = host1x_to_tegra_bo(reloc->target.bo);
+
+		if (reloc->target.offset & 3 ||
+		    reloc->target.offset > obj->gem.size) {
+			err = -EINVAL;
+			goto fail;
+		}
 	}
 
 	if (copy_from_user(job->waitchk, waitchks,

drivers/gpu/drm/tegra/gem.c +0 -5

index b76d7ac75696..a0ff30c01ac1 100644
@@ -20,11 +20,6 @@
 #include "drm.h"
 #include "gem.h"
 
-static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
-{
-	return container_of(bo, struct tegra_bo, base);
-}
-
 static void tegra_bo_put(struct host1x_bo *bo)
 {
 	struct tegra_bo *obj = host1x_to_tegra_bo(bo);

drivers/gpu/drm/tegra/gem.h +5 -0

index 6c5f12ac0087..8b32a6fd586d 100644
@@ -52,6 +52,11 @@ static inline struct tegra_bo *to_tegra_bo(struct drm_gem_object *gem)
 	return container_of(gem, struct tegra_bo, gem);
 }
 
+static inline struct tegra_bo *host1x_to_tegra_bo(struct host1x_bo *bo)
+{
+	return container_of(bo, struct tegra_bo, base);
+}
+
 struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size,
 				 unsigned long flags);
 struct tegra_bo *tegra_bo_create_with_handle(struct drm_file *file,

Quoted 80 lines · Dmitry Osipenko

If commands buffer claims a number of words that is higher than its BO can fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. The CMDA commands buffer address is 4 bytes aligned, so check the alignment as well.

Add a sanity check for the relocations in a same way.

[   46.829393] Unable to handle kernel paging request at virtual address

f09b2000
...
[<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510)
[<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c) [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec) [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4) [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c) [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)

Signed-off-by Dmitry Osipenko <[email protected]>

Reviewed-by Erik Faye-Lund <[email protected]>

---
 drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
 drivers/gpu/drm/tegra/gem.c |  5 -----
 drivers/gpu/drm/tegra/gem.h |  5 +++++
 3 files changed, 35 insertions(+), 5 deletions(-)

drivers/gpu/drm/tegra/drm.c +2 -0

index 768750226452..c5844a065681 100644
@@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
        while (num_cmdbufs) {
                struct drm_tegra_cmdbuf cmdbuf;
                struct host1x_bo *bo;
+               struct tegra_bo *obj;
+               u64 offset;
 
                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {

                        err = -EFAULT;

drivers/gpu/drm/tegra/drm.c +8 -0

@@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
                        goto fail;
                }
 
+               offset = (u64)cmdbuf.offset + (u64)cmdbuf.words *
 sizeof(u32);
+               obj = host1x_to_tegra_bo(bo);
+
+               if (offset & 3 || offset > obj->gem.size) {
+                       err = -EINVAL;
+                       goto fail;
+               }
+
                host1x_job_add_gather(job, bo, cmdbuf.words,

cmdbuf.offset);
                num_cmdbufs--;
                cmdbufs++;

drivers/gpu/drm/tegra/drm.c +8 -0

@@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
 
        /* copy and resolve relocations from submit */
        while (num_relocs--) {
+               struct host1x_reloc *reloc;
+               struct tegra_bo *obj;
+
                err =
 host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
                                                  &relocs[num_relocs],
 drm,
                                                  file);
                if (err < 0)
                        goto fail;
+
+               reloc = &job->relocarray[num_relocs];
+               obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
+
+               if (reloc->cmdbuf.offset & 3 ||

drivers/gpu/drm/tegra/drm.c int tegra_drm_submit(struct tegra_drm_context *context, · line 407

Quoted 1 line

drivers/gpu/drm/tegra/drm.c +1 -0

+                   reloc->cmdbuf.offset > obj->gem.size) {

This could still fail if the bo's size is not divisible by 4, even with >= comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the same as in the gather case, i.e. find out the address immediately after the write and compare using >. Perhaps add a helper function if it makes sense. I also don't think the "& 3" checks are needed.

Quoted 81 lines · Mikko Perttunen

Quoted 80 lines · Dmitry Osipenko

If commands buffer claims a number of words that is higher than its BO can fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. The CMDA commands buffer address is 4 bytes aligned, so check the alignment as well.

Add a sanity check for the relocations in a same way.

[   46.829393] Unable to handle kernel paging request at virtual address

f09b2000
...
[<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510)
[<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c) [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec) [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4) [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c) [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)

Signed-off-by Dmitry Osipenko <[email protected]>

Reviewed-by Erik Faye-Lund <[email protected]>

---
 drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
 drivers/gpu/drm/tegra/gem.c |  5 -----
 drivers/gpu/drm/tegra/gem.h |  5 +++++
 3 files changed, 35 insertions(+), 5 deletions(-)

drivers/gpu/drm/tegra/drm.c +2 -0

index 768750226452..c5844a065681 100644
@@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
        while (num_cmdbufs) {
                struct drm_tegra_cmdbuf cmdbuf;
                struct host1x_bo *bo;
+               struct tegra_bo *obj;
+               u64 offset;
 
                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {

                        err = -EFAULT;

drivers/gpu/drm/tegra/drm.c +8 -0

@@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
                        goto fail;
                }
 
+               offset = (u64)cmdbuf.offset + (u64)cmdbuf.words *
 sizeof(u32);
+               obj = host1x_to_tegra_bo(bo);
+
+               if (offset & 3 || offset > obj->gem.size) {
+                       err = -EINVAL;
+                       goto fail;
+               }
+
                host1x_job_add_gather(job, bo, cmdbuf.words,

cmdbuf.offset);
                num_cmdbufs--;
                cmdbufs++;

drivers/gpu/drm/tegra/drm.c +8 -0

@@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
 
        /* copy and resolve relocations from submit */
        while (num_relocs--) {
+               struct host1x_reloc *reloc;
+               struct tegra_bo *obj;
+
                err =
 host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
                                                  &relocs[num_relocs],
 drm,
                                                  file);
                if (err < 0)
                        goto fail;
+
+               reloc = &job->relocarray[num_relocs];
+               obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
+
+               if (reloc->cmdbuf.offset & 3 ||

Quoted 8 lines

drivers/gpu/drm/tegra/drm.c int tegra_drm_submit(struct tegra_drm_context *context, · line 407

Quoted 1 line

drivers/gpu/drm/tegra/drm.c +1 -0

+                   reloc->cmdbuf.offset > obj->gem.size) {

This could still fail if the bo's size is not divisible by 4, even with >= comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the same as in the gather case, i.e. find out the address immediately after the write and compare using >. Perhaps add a helper function if it makes sense. I also don't think the "& 3" checks are needed.

The bo-size is always a multiple of PAGE_SIZE, due to the rounding in tegra_bo_alloc_object(), so I don't think this actually can fail. But maybe we want to future-proof this code for a potential future where this is not the case?

Quoted 91 lines · Erik Faye-Lund

Quoted 89 lines · Mikko Perttunen

Quoted 71 lines · Dmitry Osipenko

If commands buffer claims a number of words that is higher than its BO can fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. The CMDA commands buffer address is 4 bytes aligned, so check the alignment as well.

Add a sanity check for the relocations in a same way.

[   46.829393] Unable to handle kernel paging request at virtual address

f09b2000
...
[<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510)
[<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c) [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec) [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4) [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c) [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c)

Signed-off-by Dmitry Osipenko <[email protected]>

Reviewed-by Erik Faye-Lund <[email protected]>

---
 drivers/gpu/drm/tegra/drm.c | 30 ++++++++++++++++++++++++++++++
 drivers/gpu/drm/tegra/gem.c |  5 -----
 drivers/gpu/drm/tegra/gem.h |  5 +++++
 3 files changed, 35 insertions(+), 5 deletions(-)

drivers/gpu/drm/tegra/drm.c +2 -0

index 768750226452..c5844a065681 100644
@@ -362,6 +362,8 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
        while (num_cmdbufs) {
                struct drm_tegra_cmdbuf cmdbuf;
                struct host1x_bo *bo;
+               struct tegra_bo *obj;
+               u64 offset;
 
                if (copy_from_user(&cmdbuf, cmdbufs, sizeof(cmdbuf))) {

                        err = -EFAULT;

drivers/gpu/drm/tegra/drm.c +8 -0

@@ -374,6 +376,14 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
                        goto fail;
                }
 
+               offset = (u64)cmdbuf.offset + (u64)cmdbuf.words *
 sizeof(u32);
+               obj = host1x_to_tegra_bo(bo);
+
+               if (offset & 3 || offset > obj->gem.size) {
+                       err = -EINVAL;
+                       goto fail;
+               }
+
                host1x_job_add_gather(job, bo, cmdbuf.words,

cmdbuf.offset);
                num_cmdbufs--;
                cmdbufs++;

drivers/gpu/drm/tegra/drm.c +3 -0

@@ -381,11 +391,31 @@ int tegra_drm_submit(struct tegra_drm_context
 *context,
 
        /* copy and resolve relocations from submit */
        while (num_relocs--) {
+               struct host1x_reloc *reloc;
+               struct tegra_bo *obj;
+
                err =
 host1x_reloc_copy_from_user(&job->relocarray[num_relocs],
                                                  &relocs[num_relocs],

drivers/gpu/drm/tegra/drm.c int tegra_drm_submit(struct tegra_drm_context · line 410

Quoted 10 lines

drivers/gpu/drm/tegra/drm.c +6 -0

 drm,
                                                  file);
                if (err < 0)
                        goto fail;
+
+               reloc = &job->relocarray[num_relocs];
+               obj = host1x_to_tegra_bo(reloc->cmdbuf.bo);
+
+               if (reloc->cmdbuf.offset & 3 ||
+                   reloc->cmdbuf.offset > obj->gem.size) {

This could still fail if the bo's size is not divisible by 4, even with >= comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the same as in the gather case, i.e. find out the address immediately after the write and compare using >. Perhaps add a helper function if it makes sense. I also don't think the "& 3" checks are needed.

Quoted 5 lines

The bo-size is always a multiple of PAGE_SIZE, due to the rounding in tegra_bo_alloc_object(), so I don't think this actually can fail. But maybe we want to future-proof this code for a potential future where this is not the case?

Yeah, I think whether or not this might change in the future, the code would be easier to understand with the change.

drivers/gpu/drm/tegra/drm.c int tegra_drm_submit(struct tegra_drm_context *context, · line 407

Quoted 2 lines · Dmitry Osipenko

drivers/gpu/drm/tegra/drm.c +2 -0

+        if (reloc->cmdbuf.offset & 3 ||
+            reloc->cmdbuf.offset > obj->gem.size) {

This could still fail if the bo's size is not divisible by 4, even with >= comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the same as in the gather case, i.e. find out the address immediately after the write and compare using >. Perhaps add a helper function if it makes sense. I also don't think the "& 3" checks are needed.

The client ID 0 is reserved by the host1x/cdma to mark the timeout timer work as already been scheduled and context ID is used as the clients one. This fixes spurious CDMA timeouts.

Fixes bdd2f9cd10eb ("drm/tegra: Don't leak kernel pointer to userspace")

Signed-off-by Dmitry Osipenko <[email protected]>

---

v2: Changed the commit description, now explains the cause of CDMA timeouts.

 drivers/gpu/drm/tegra/drm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/gpu/drm/tegra/drm.c +1 -1

index c5844a065681..489cb32453f7 100644
@@ -548,7 +548,7 @@ static int tegra_client_open(struct tegra_drm_file *fpriv,
 	if (err < 0)
 		return err;
 
-	err = idr_alloc(&fpriv->contexts, context, 0, 0, GFP_KERNEL);
+	err = idr_alloc(&fpriv->contexts, context, 1, 0, GFP_KERNEL);
 	if (err < 0) {
 		client->ops->close_channel(context);
 		return err;