forked from Minki/linux
368f622c0d
If commands buffer claims a number of words that is higher than its BO can fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. The CDMA commands buffer address is 4 bytes aligned, so check its alignment. The maximum number of the CDMA gather fetches is 16383, add a check for it. Add a sanity check for the relocations in a same way. [ 46.829393] Unable to handle kernel paging request at virtual address f09b2000 ... [<c04a3ba4>] (host1x_job_pin) from [<c04dfcd0>] (tegra_drm_submit+0x474/0x510) [<c04dfcd0>] (tegra_drm_submit) from [<c04deea0>] (tegra_submit+0x50/0x6c) [<c04deea0>] (tegra_submit) from [<c04c07c0>] (drm_ioctl+0x1e4/0x3ec) [<c04c07c0>] (drm_ioctl) from [<c02541a0>] (do_vfs_ioctl+0x9c/0x8e4) [<c02541a0>] (do_vfs_ioctl) from [<c0254a1c>] (SyS_ioctl+0x34/0x5c) [<c0254a1c>] (SyS_ioctl) from [<c0107640>] (ret_fast_syscall+0x0/0x3c) Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Reviewed-by: Erik Faye-Lund <kusmabite@gmail.com> Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> |
||
|---|---|---|
| .. | ||
| dc.c | ||
| dc.h | ||
| dpaux.c | ||
| dpaux.h | ||
| drm.c | ||
| drm.h | ||
| dsi.c | ||
| dsi.h | ||
| falcon.c | ||
| falcon.h | ||
| fb.c | ||
| gem.c | ||
| gem.h | ||
| gr2d.c | ||
| gr2d.h | ||
| gr3d.c | ||
| gr3d.h | ||
| hdmi.c | ||
| hdmi.h | ||
| Kconfig | ||
| Makefile | ||
| mipi-phy.c | ||
| mipi-phy.h | ||
| output.c | ||
| rgb.c | ||
| sor.c | ||
| sor.h | ||
| vic.c | ||
| vic.h | ||