It sounds unwise to let user space pass an unchecked 32-bit
offset into a kernel structure in an ioctl. This is an unsigned
variable, so checking the upper bound for the size of the structure
it points into is sufficient to avoid data corruption, but as
the pointer might also be unaligned, it has to be written carefully
as well.
While I stumbled over this problem by reading the code, I did not
continue checking the function for further problems like it.
Cc: stable(a)vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
drivers/scsi/megaraid/megaraid_sas_base.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 861f7140f52e..c3de69f3bee8 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -8095,7 +8095,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
int error = 0, i;
void *sense = NULL;
dma_addr_t sense_handle;
- unsigned long *sense_ptr;
+ void *sense_ptr;
u32 opcode = 0;
int ret = DCMD_SUCCESS;
@@ -8218,6 +8218,12 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
}
if (ioc->sense_len) {
+ /* make sure the pointer is part of the frame */
+ if (ioc->sense_off > (sizeof(union megasas_frame) - sizeof(__le64))) {
+ error = -EINVAL;
+ goto out;
+ }
+
sense = dma_alloc_coherent(&instance->pdev->dev, ioc->sense_len,
&sense_handle, GFP_KERNEL);
if (!sense) {
@@ -8225,12 +8231,11 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
goto out;
}
- sense_ptr =
- (unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
+ sense_ptr = (void *)cmd->frame + ioc->sense_off;
if (instance->consistent_mask_64bit)
- *sense_ptr = cpu_to_le64(sense_handle);
+ put_unaligned_le64(sense_handle, sense_ptr);
else
- *sense_ptr = cpu_to_le32(sense_handle);
+ put_unaligned_le32(sense_handle, sense_ptr);
}
/*
--
2.27.0
On 2020-12-29 9:54 a.m., Deucher, Alexander wrote:
> [AMD Public Use]
>
>
> I don't know if these fixes related to modifiers make sense in the
> pre-modifier code base. Bas, Nick?
>
> Alex
Mesa should be the only userspace trying to make use of DCC and it
doesn't do it for video formats. From the kernel side of things we've
also never supported this and you'd get corruption on the screen if you
tried.
It's a "fix" for both pre-modifiers and post-modifiers code.
Regards,
Nicholas Kazlauskas
> ------------------------------------------------------------------------
> *From:* amd-gfx <amd-gfx-bounces(a)lists.freedesktop.org> on behalf of
> Sasha Levin <sashal(a)kernel.org>
> *Sent:* Tuesday, December 22, 2020 9:16 PM
> *To:* linux-kernel(a)vger.kernel.org <linux-kernel(a)vger.kernel.org>;
> stable(a)vger.kernel.org <stable(a)vger.kernel.org>
> *Cc:* Sasha Levin <sashal(a)kernel.org>; dri-devel(a)lists.freedesktop.org
> <dri-devel(a)lists.freedesktop.org>; amd-gfx(a)lists.freedesktop.org
> <amd-gfx(a)lists.freedesktop.org>; Bas Nieuwenhuizen
> <bas(a)basnieuwenhuizen.nl>; Deucher, Alexander
> <Alexander.Deucher(a)amd.com>; Kazlauskas, Nicholas
> <Nicholas.Kazlauskas(a)amd.com>
> *Subject:* [PATCH AUTOSEL 5.4 006/130] drm/amd/display: Do not silently
> accept DCC for multiplane formats.
> From: Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl>
>
> [ Upstream commit b35ce7b364ec80b54f48a8fdf9fb74667774d2da ]
>
> Silently accepting it could result in corruption.
>
> Signed-off-by: Bas Nieuwenhuizen <bas(a)basnieuwenhuizen.nl>
> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com>
> Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas(a)amd.com>
> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com>
> Signed-off-by: Sasha Levin <sashal(a)kernel.org>
> ---
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> index d2dd387c95d86..ce70c42a2c3ec 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> @@ -2734,7 +2734,7 @@ fill_plane_dcc_attributes(struct amdgpu_device *adev,
> return 0;
>
> if (format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN)
> - return 0;
> + return -EINVAL;
>
> if (!dc->cap_funcs.get_dcc_compression_cap)
> return -EINVAL;
> --
> 2.27.0
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx(a)lists.freedesktop.org
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fre…
> <https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fre…>