drm/i915/cmdparser: Do not check past the cmd length.

"Linux Kernel Mailing List" <[email protected]>
Newsgroups gmane.linux.kernel.commits.head
Message-ID <[email protected]>
Web:        https://git.kernel.org/torvalds/c/b3ad99ed45917f42884fee731fa3cf9b8229a26c
Commit:     b3ad99ed45917f42884fee731fa3cf9b8229a26c
Parent:     b18224e95cb13ef7517aa26e6b47c85117327f11
Refname:    refs/heads/master
Author:     Michal Srb <[email protected]>
AuthorDate: Mon Feb 5 16:04:38 2018 +0000
Committer:  Rodrigo Vivi <[email protected]>
CommitDate: Tue Feb 6 11:41:40 2018 -0800

    drm/i915/cmdparser: Do not check past the cmd length.
    
    The command MEDIA_VFE_STATE checks bits at offset +2 dwords. However, it is
    possible to have MEDIA_VFE_STATE command with length = 0 + LENGTH_BIAS = 2.
    In that case check_cmd will read bits from the following command, or even past
    the end of the buffer.
    
    If the offset ends up outside of the command length, reject the command.
    
    Fixes: 351e3db2b363 ("drm/i915: Implement command buffer parsing logic")
    Signed-off-by: Michal Srb <[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
    Reviewed-by: Chris Wilson <[email protected]>
    Signed-off-by: Chris Wilson <[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
    (cherry picked from commit 3aec7f871c65eb5f76b4125fda432593c834a6f2)
    Signed-off-by: Rodrigo Vivi <[email protected]>
---
 drivers/gpu/drm/i915/i915_cmd_parser.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c
index ab4c8b0ec886..95478db9998b 100644
--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
@@ -1212,6 +1212,12 @@ static bool check_cmd(const struct intel_engine_cs *engine,
 					continue;
 			}
 
+			if (desc->bits[i].offset >= length) {
+				DRM_DEBUG_DRIVER("CMD: Rejected command 0x%08X, too short to check bitmask (%s)\n",
+						 *cmd, engine->name);
+				return false;
+			}
+
 			dword = cmd[desc->bits[i].offset] &
 				desc->bits[i].mask;
 
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.