A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 13:49:24 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: kgsl: Prevent wrap around during user address mapping

Browse source 
When setting svm region during the gpuobj import ioctl call for a usermem
address, there is a possibility of a very large input size causing the
region's 64-bit end address to wrap around. This can cause the region
to incorrectly be considered valid, ultimately allowing a use after free
scenario. To prevent this, detect the occurrence of a wrap and reject the
import.

Change-Id: I4a88f56c58b830d4342e47dc1d1f6290c78ab6b4
Signed-off-by: Mohammed Mirza Mandayappurath Manzoor <quic_mmandaya@quicinc.com>
Signed-off-by: Pankaj Gupta <quic_gpankaj@quicinc.com>
This commit is contained in:
Pankaj Gupta 2023-09-14 21:44:26 +05:30
commit 970275cba2
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
drivers/gpu/msm/kgsl_iommu.c
View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/bitfield.h>
@ -2157,14 +2158,18 @@ static uint64_t kgsl_iommu_find_svm_region(struct kgsl_pagetable *pagetable,
static bool iommu_addr_in_svm_ranges(struct kgsl_iommu_pt *pt,
u64 gpuaddr, u64 size)
{
u64 end = gpuaddr + size;
/* Make sure size is not zero and we don't wrap around */
if (end <= gpuaddr)
return false;
if ((gpuaddr >= pt->compat_va_start && gpuaddr < pt->compat_va_end) &&
((gpuaddr + size) > pt->compat_va_start &&
(gpuaddr + size) <= pt->compat_va_end))
(end > pt->compat_va_start && end <= pt->compat_va_end))
return true;
if ((gpuaddr >= pt->svm_start && gpuaddr < pt->svm_end) &&
((gpuaddr + size) > pt->svm_start &&
(gpuaddr + size) <= pt->svm_end))
(end > pt->svm_start && end <= pt->svm_end))
return true;
return false;