From e219688fc5c3d0d9136f8d29d7e0498388f01440 Mon Sep 17 00:00:00 2001 From: Doug Horn Date: Wed, 2 Sep 2020 14:08:25 -0700 Subject: Fix use after free in get_capset_info callback. If a response to virtio_gpu_cmd_get_capset_info takes longer than five seconds to return, the callback will access freed kernel memory in vg->capsets. Signed-off-by: Doug Horn Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-2-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann --- drivers/gpu/drm/virtio/virtgpu_vq.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'drivers/gpu/drm/virtio/virtgpu_vq.c') diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index c93c2db35aaf..7436705ba5a2 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -684,9 +684,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev, int i = le32_to_cpu(cmd->capset_index); spin_lock(&vgdev->display_info_lock); - vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); - vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); - vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); + if (vgdev->capsets) { + vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); + vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); + vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); + } else { + DRM_ERROR("invalid capset memory."); + } spin_unlock(&vgdev->display_info_lock); wake_up(&vgdev->resp_wq); } -- cgit v1.2.3-70-g09d2 From b7170f9457f282783b6f3843e2b30d619449837c Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Tue, 8 Sep 2020 09:07:22 +0200 Subject: drm/virtio: return virtio_gpu_queue errors In case queuing virtio commands fails (can happen when the device got unplugged) pass up the error. Signed-off-by: Gerd Hoffmann Reviewed-by: Gurchetan Singh Link: http://patchwork.freedesktop.org/patch/msgid/20200908070723.6394-3-kraxel@redhat.com --- drivers/gpu/drm/virtio/virtgpu_vq.c | 38 +++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) (limited to 'drivers/gpu/drm/virtio/virtgpu_vq.c') diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 7436705ba5a2..d0f7f494c610 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -320,13 +320,13 @@ static struct sg_table *vmalloc_to_sgt(char *data, uint32_t size, int *sg_ents) return sgt; } -static void virtio_gpu_queue_ctrl_sgs(struct virtio_gpu_device *vgdev, - struct virtio_gpu_vbuffer *vbuf, - struct virtio_gpu_fence *fence, - int elemcnt, - struct scatterlist **sgs, - int outcnt, - int incnt) +static int virtio_gpu_queue_ctrl_sgs(struct virtio_gpu_device *vgdev, + struct virtio_gpu_vbuffer *vbuf, + struct virtio_gpu_fence *fence, + int elemcnt, + struct scatterlist **sgs, + int outcnt, + int incnt) { struct virtqueue *vq = vgdev->ctrlq.vq; int ret, idx; @@ -335,7 +335,7 @@ static void virtio_gpu_queue_ctrl_sgs(struct virtio_gpu_device *vgdev, if (fence && vbuf->objs) virtio_gpu_array_unlock_resv(vbuf->objs); free_vbuf(vgdev, vbuf); - return; + return -1; } if (vgdev->has_indirect) @@ -373,15 +373,16 @@ again: spin_unlock(&vgdev->ctrlq.qlock); drm_dev_exit(idx); + return 0; } -static void virtio_gpu_queue_fenced_ctrl_buffer(struct virtio_gpu_device *vgdev, - struct virtio_gpu_vbuffer *vbuf, - struct virtio_gpu_fence *fence) +static int virtio_gpu_queue_fenced_ctrl_buffer(struct virtio_gpu_device *vgdev, + struct virtio_gpu_vbuffer *vbuf, + struct virtio_gpu_fence *fence) { struct scatterlist *sgs[3], vcmd, vout, vresp; struct sg_table *sgt = NULL; - int elemcnt = 0, outcnt = 0, incnt = 0; + int elemcnt = 0, outcnt = 0, incnt = 0, ret; /* set up vcmd */ sg_init_one(&vcmd, vbuf->buf, vbuf->size); @@ -398,7 +399,7 @@ static void virtio_gpu_queue_fenced_ctrl_buffer(struct virtio_gpu_device *vgdev, if (!sgt) { if (fence && vbuf->objs) virtio_gpu_array_unlock_resv(vbuf->objs); - return; + return -1; } elemcnt += sg_ents; @@ -419,13 +420,14 @@ static void virtio_gpu_queue_fenced_ctrl_buffer(struct virtio_gpu_device *vgdev, incnt++; } - virtio_gpu_queue_ctrl_sgs(vgdev, vbuf, fence, elemcnt, sgs, outcnt, - incnt); + ret = virtio_gpu_queue_ctrl_sgs(vgdev, vbuf, fence, elemcnt, sgs, outcnt, + incnt); if (sgt) { sg_free_table(sgt); kfree(sgt); } + return ret; } void virtio_gpu_notify(struct virtio_gpu_device *vgdev) @@ -444,10 +446,10 @@ void virtio_gpu_notify(struct virtio_gpu_device *vgdev) virtqueue_notify(vgdev->ctrlq.vq); } -static void virtio_gpu_queue_ctrl_buffer(struct virtio_gpu_device *vgdev, - struct virtio_gpu_vbuffer *vbuf) +static int virtio_gpu_queue_ctrl_buffer(struct virtio_gpu_device *vgdev, + struct virtio_gpu_vbuffer *vbuf) { - virtio_gpu_queue_fenced_ctrl_buffer(vgdev, vbuf, NULL); + return virtio_gpu_queue_fenced_ctrl_buffer(vgdev, vbuf, NULL); } static void virtio_gpu_queue_cursor(struct virtio_gpu_device *vgdev, -- cgit v1.2.3-70-g09d2 From 9fe6bda9823ea90c22ad47436293413d5fd58991 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Tue, 8 Sep 2020 09:07:23 +0200 Subject: drm/virtio: add virtio_gpu_cmd_unref_resource error handling Usually we wait for the host to complete the unref request, then cleanup the guest-side state of the object in the completion callback. When submitting the unref command failed the completion callback will not be called though, so cleanup right away. Fixes a WARN on stale mm entries on driver shutdown. Signed-off-by: Gerd Hoffmann Reviewed-by: Gurchetan Singh Link: http://patchwork.freedesktop.org/patch/msgid/20200908070723.6394-4-kraxel@redhat.com --- drivers/gpu/drm/virtio/virtgpu_vq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'drivers/gpu/drm/virtio/virtgpu_vq.c') diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index d0f7f494c610..a7550044b8b2 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -536,6 +536,7 @@ void virtio_gpu_cmd_unref_resource(struct virtio_gpu_device *vgdev, { struct virtio_gpu_resource_unref *cmd_p; struct virtio_gpu_vbuffer *vbuf; + int ret; cmd_p = virtio_gpu_alloc_cmd_cb(vgdev, &vbuf, sizeof(*cmd_p), virtio_gpu_cmd_unref_cb); @@ -545,7 +546,9 @@ void virtio_gpu_cmd_unref_resource(struct virtio_gpu_device *vgdev, cmd_p->resource_id = cpu_to_le32(bo->hw_res_handle); vbuf->resp_cb_data = bo; - virtio_gpu_queue_ctrl_buffer(vgdev, vbuf); + ret = virtio_gpu_queue_ctrl_buffer(vgdev, vbuf); + if (ret < 0) + virtio_gpu_cleanup_object(bo); } void virtio_gpu_cmd_set_scanout(struct virtio_gpu_device *vgdev, -- cgit v1.2.3-70-g09d2