diff options
Diffstat (limited to 'meta-amdfalconx86/recipes-kernel/linux/files/1026-drm-amdgpu-forbid-mapping-of-userptr-bo-through-rade.patch')
| -rw-r--r-- | meta-amdfalconx86/recipes-kernel/linux/files/1026-drm-amdgpu-forbid-mapping-of-userptr-bo-through-rade.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/meta-amdfalconx86/recipes-kernel/linux/files/1026-drm-amdgpu-forbid-mapping-of-userptr-bo-through-rade.patch b/meta-amdfalconx86/recipes-kernel/linux/files/1026-drm-amdgpu-forbid-mapping-of-userptr-bo-through-rade.patch new file mode 100644 index 00000000..920b174f --- /dev/null +++ b/meta-amdfalconx86/recipes-kernel/linux/files/1026-drm-amdgpu-forbid-mapping-of-userptr-bo-through-rade.patch @@ -0,0 +1,45 @@ +From 8343ac3454dfd121bee9bbc686d36b5365966c8c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com> +Date: Tue, 19 Apr 2016 09:07:51 -0400 +Subject: [PATCH 1026/1110] drm/amdgpu: forbid mapping of userptr bo through + radeon device file +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Allowing userptr bo which are basicly a list of page from some vma +(so either anonymous page or file backed page) would lead to serious +corruption of kernel structures and counters (because we overwrite +the page->mapping field when mapping buffer). + +This will already block if the buffer was populated before anyone does +try to mmap it because then TTM_PAGE_FLAG_SG would be set in in the +ttm_tt flags. But that flag is check before ttm_tt_populate in the ttm +vm fault handler. + +So to be safe just add a check to verify_access() callback. + +Reviewed-by: Christian König <christian.koenig@amd.com> +Signed-off-by: Jérôme Glisse <jglisse@redhat.com> +Cc: <stable@vger.kernel.org> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 70f005d..e296415 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -223,6 +223,8 @@ static int amdgpu_verify_access(struct ttm_buffer_object *bo, struct file *filp) + { + struct amdgpu_bo *rbo = container_of(bo, struct amdgpu_bo, tbo); + ++ if (amdgpu_ttm_tt_get_usermm(bo->ttm)) ++ return -EPERM; + return drm_vma_node_verify_access(&rbo->gem_base.vma_node, filp); + } + +-- +2.7.4 + |