FAILED: patch "[PATCH] drm/i915: Sanity check mmap length against object size" failed to apply to 5.0-stable tree

PATCH [email protected] 1 participant 1 message Mar 24, 2019

Subsystems (3)

Stable branch DRM drivers Intel i915

lore

Share & tools

lore

[email protected]

author maintainer

2019-03-24 19:53 UTC #0 lore raw

The patch below does not apply to the 5.0-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 000c4f90e3f0194eef218ff2c6a8fd8ca1de4313 Mon Sep 17 00:00:00 2001
From: Chris Wilson <[email protected]>
Date: Thu, 14 Mar 2019 07:58:29 +0000
Subject: [PATCH] drm/i915: Sanity check mmap length against object size

We assumed that vm_mmap() would reject an attempt to mmap past the end of the filp (our object), but we were wrong.

Applications that tried to use the mmap beyond the end of the object would be greeted by a SIGBUS. After this patch, those applications will be told about the error on creating the mmap, rather than at a random moment on later access.

Reported-by Antonio Argenziano <[email protected]>

Testcase: igt/gem_mmap/bad-size

Signed-off-by Chris Wilson <[email protected]>

Cc Antonio Argenziano <[email protected]>

Cc Joonas Lahtinen <[email protected]>

Cc Tvrtko Ursulin <[email protected]>

Cc [email protected]

Reviewed-by Tvrtko Ursulin <[email protected]>

Reviewed-by Joonas Lahtinen <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

(cherry picked from commit 794a11cb67201ad1bb61af510bb8460280feb3f3)

Signed-off-by Rodrigo Vivi <[email protected]>

drivers/gpu/drm/i915/i915_gem.c +9 -6

index 30d516e975c6..8558e81fdc2a 100644
@@ -1734,8 +1734,13 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 	 * pages from.
 	 */
 	if (!obj->base.filp) {
-		i915_gem_object_put(obj);
-		return -ENXIO;
+		addr = -ENXIO;
+		goto err;
+	}
+
+	if (range_overflows(args->offset, args->size, (u64)obj->base.size)) {
+		addr = -EINVAL;
+		goto err;
 	}
 
 	addr = vm_mmap(obj->base.filp, 0, args->size,

@@ -1749,8 +1754,8 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 		struct vm_area_struct *vma;
 
 		if (down_write_killable(&mm->mmap_sem)) {
-			i915_gem_object_put(obj);
-			return -EINTR;
+			addr = -EINTR;
+			goto err;
 		}
 		vma = find_vma(mm, addr);
 		if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))

@@ -1768,12 +1773,10 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 	i915_gem_object_put(obj);
 
 	args->addr_ptr = (u64)addr;
-
 	return 0;
 
 err:
 	i915_gem_object_put(obj);
-
 	return addr;
 }