From 0666a8d7f6a4530440e59f2d22ed4091f4d3818c Mon Sep 17 00:00:00 2001 From: Jiri Slaby Date: Thu, 19 Mar 2020 11:04:21 +0100 Subject: drm/virtio: fix OOB in virtio_gpu_object_create After commit f651c8b05542 ("drm/virtio: factor out the sg_table from virtio_gpu_object"), virtio_gpu_create_object allocates too small space to fit everything in. It is because it allocates struct virtio_gpu_object, but should allocate a newly added struct virtio_gpu_object_shmem which has 2 more members. So fix that by using correct type in virtio_gpu_create_object. Signed-off-by: Jiri Slaby Link: http://patchwork.freedesktop.org/patch/msgid/20200319100421.16267-1-jslaby@suse.cz Fixes: f651c8b05542 ("drm/virtio: factor out the sg_table from virtio_gpu_object") Cc: Gurchetan Singh Cc: Gerd Hoffmann Signed-off-by: Gerd Hoffmann --- drivers/gpu/drm/virtio/virtgpu_object.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'drivers/gpu/drm/virtio/virtgpu_object.c') diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 2bfb13d1932e..d9039bb7c5e3 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -123,15 +123,17 @@ bool virtio_gpu_is_shmem(struct virtio_gpu_object *bo) struct drm_gem_object *virtio_gpu_create_object(struct drm_device *dev, size_t size) { - struct virtio_gpu_object *bo; + struct virtio_gpu_object_shmem *shmem; + struct drm_gem_shmem_object *dshmem; - bo = kzalloc(sizeof(*bo), GFP_KERNEL); - if (!bo) + shmem = kzalloc(sizeof(*shmem), GFP_KERNEL); + if (!shmem) return NULL; - bo->base.base.funcs = &virtio_gpu_shmem_funcs; - bo->base.map_cached = true; - return &bo->base.base; + dshmem = &shmem->base.base; + dshmem->base.funcs = &virtio_gpu_shmem_funcs; + dshmem->map_cached = true; + return &dshmem->base; } static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, -- cgit From 6457a0df4df2bba9d395bc93476a84219f661b41 Mon Sep 17 00:00:00 2001 From: Gurchetan Singh Date: Wed, 1 Apr 2020 15:30:37 -0700 Subject: drm/virtio: delete notify in virtio_gpu_object_create For 3D buffers, virtio_gpu_gem_object_open notifies. We can have the same behavior for dumb buffer. v2: virtio_gpu_gem_object_open always notifies v3: avoid boolean variable Signed-off-by: Gurchetan Singh Reviewed-by: Chia-I Wu Link: http://patchwork.freedesktop.org/patch/msgid/20200401223039.2860-3-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann --- drivers/gpu/drm/virtio/virtgpu_gem.c | 3 ++- drivers/gpu/drm/virtio/virtgpu_object.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/gpu/drm/virtio/virtgpu_object.c') diff --git a/drivers/gpu/drm/virtio/virtgpu_gem.c b/drivers/gpu/drm/virtio/virtgpu_gem.c index 90c0a8ea1708..1025658be4df 100644 --- a/drivers/gpu/drm/virtio/virtgpu_gem.c +++ b/drivers/gpu/drm/virtio/virtgpu_gem.c @@ -114,7 +114,7 @@ int virtio_gpu_gem_object_open(struct drm_gem_object *obj, struct virtio_gpu_object_array *objs; if (!vgdev->has_virgl_3d) - return 0; + goto out_notify; objs = virtio_gpu_array_alloc(1); if (!objs) @@ -123,6 +123,7 @@ int virtio_gpu_gem_object_open(struct drm_gem_object *obj, virtio_gpu_cmd_context_attach_resource(vgdev, vfpriv->ctx_id, objs); +out_notify: virtio_gpu_notify(vgdev); return 0; } diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index d9039bb7c5e3..51a8da7d5ef3 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -241,7 +241,6 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, return ret; } - virtio_gpu_notify(vgdev); *bo_ptr = bo; return 0; -- cgit From c76d4ab764adaef6ee4c385df2df24dbaea88412 Mon Sep 17 00:00:00 2001 From: Gurchetan Singh Date: Wed, 1 Apr 2020 15:30:38 -0700 Subject: drm/virtio: make virtio_gpu_object_attach void It always returns zero. Signed-off-by: Gurchetan Singh Link: http://patchwork.freedesktop.org/patch/msgid/20200401223039.2860-4-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann --- drivers/gpu/drm/virtio/virtgpu_drv.h | 8 ++++---- drivers/gpu/drm/virtio/virtgpu_object.c | 6 +----- drivers/gpu/drm/virtio/virtgpu_vq.c | 9 ++++----- 3 files changed, 9 insertions(+), 14 deletions(-) (limited to 'drivers/gpu/drm/virtio/virtgpu_object.c') diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h index 79ad176aca5a..49bebdee6d91 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -279,10 +279,10 @@ void virtio_gpu_cmd_set_scanout(struct virtio_gpu_device *vgdev, uint32_t scanout_id, uint32_t resource_id, uint32_t width, uint32_t height, uint32_t x, uint32_t y); -int virtio_gpu_object_attach(struct virtio_gpu_device *vgdev, - struct virtio_gpu_object *obj, - struct virtio_gpu_mem_entry *ents, - unsigned int nents); +void virtio_gpu_object_attach(struct virtio_gpu_device *vgdev, + struct virtio_gpu_object *obj, + struct virtio_gpu_mem_entry *ents, + unsigned int nents); int virtio_gpu_attach_status_page(struct virtio_gpu_device *vgdev); int virtio_gpu_detach_status_page(struct virtio_gpu_device *vgdev); void virtio_gpu_cursor_ping(struct virtio_gpu_device *vgdev, diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c index 51a8da7d5ef3..6ccbd01cd888 100644 --- a/drivers/gpu/drm/virtio/virtgpu_object.c +++ b/drivers/gpu/drm/virtio/virtgpu_object.c @@ -235,11 +235,7 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, return ret; } - ret = virtio_gpu_object_attach(vgdev, bo, ents, nents); - if (ret != 0) { - virtio_gpu_free_object(&shmem_obj->base); - return ret; - } + virtio_gpu_object_attach(vgdev, bo, ents, nents); *bo_ptr = bo; return 0; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index 73854915ec34..9e663a5d9952 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -1087,14 +1087,13 @@ void virtio_gpu_cmd_submit(struct virtio_gpu_device *vgdev, virtio_gpu_queue_fenced_ctrl_buffer(vgdev, vbuf, fence); } -int virtio_gpu_object_attach(struct virtio_gpu_device *vgdev, - struct virtio_gpu_object *obj, - struct virtio_gpu_mem_entry *ents, - unsigned int nents) +void virtio_gpu_object_attach(struct virtio_gpu_device *vgdev, + struct virtio_gpu_object *obj, + struct virtio_gpu_mem_entry *ents, + unsigned int nents) { virtio_gpu_cmd_resource_attach_backing(vgdev, obj->hw_res_handle, ents, nents, NULL); - return 0; } void virtio_gpu_cursor_ping(struct virtio_gpu_device *vgdev, -- cgit