Commit fa2fe487 authored by Xℹ Ruoyao's avatar Xℹ Ruoyao Committed by Guo Mengqi
Browse files

drm/amdgpu: check alignment on CPU page for bo map 

stable inclusion
from stable-v5.10.28
commit 8c71f5b309556503dbc8650637bcd1d2576b15f5
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9J3KG
CVE: CVE-2024-26922

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8c71f5b309556503dbc8650637bcd1d2576b15f5



--------------------------------

commit e3512fb6 upstream.

The page table of AMDGPU requires an alignment to CPU page so we should
check ioctl parameters for it.  Return -EINVAL if some parameter is
unaligned to CPU page, instead of corrupt the page table sliently.

Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarXi Ruoyao <xry111@mengyan1223.wang>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatar&nbsp; Weilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>

Signed-off-by: default avatarGuo Mengqi <guomengqi3@huawei.com>
parent 5d7f26cf

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c

+4 −4
Original line number Diff line number Diff line
@@ -2076,8 +2076,8 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev, 
	uint64_t eaddr;



	/* validate the parameters */

	if (saddr & AMDGPU_GPU_PAGE_MASK || offset & AMDGPU_GPU_PAGE_MASK ||

	    size == 0 || size & AMDGPU_GPU_PAGE_MASK)

	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||

	    size == 0 || size & ~PAGE_MASK)

		return -EINVAL;



	/* make sure object fit at this offset */
@@ -2141,8 +2141,8 @@ int amdgpu_vm_bo_replace_map(struct amdgpu_device *adev, 
	int r;



	/* validate the parameters */

	if (saddr & AMDGPU_GPU_PAGE_MASK || offset & AMDGPU_GPU_PAGE_MASK ||

	    size == 0 || size & AMDGPU_GPU_PAGE_MASK)

	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||

	    size == 0 || size & ~PAGE_MASK)

		return -EINVAL;



	/* make sure object fit at this offset */