[Intel-gfx] [PATCH] drm/i915: Pevent copying uninitialised garbage into vma->ggtt_view

[Chris Wilson]

On Mon, Jan 23, 2017 at 03:01:20PM +0000, Matthew Auld wrote:
> On 23 January 2017 at 14:52, Chris Wilson <chris at chris-wilson.co.uk> wrote:
> > Since tweaking i915_vma_compare() we allowed constructors to skip
> > clearing the ggtt_view believing that we didn't access the unused
> > members. That, as it turns out, was not entirely true. In particular,
> > i915_gem_fault() uses
> >
> >     ret = remap_io_mapping(area,
> >             area->vm_start + (vma->ggtt_view.partial.offset << PAGE_SHIFT),
> >             (ggtt->mappable_base + vma->node.start) >> PAGE_SHIFT,
> >             min_t(u64, vma->size, area->vm_end - area->vm_start),
> >             &ggtt->mappable);
> >
> > i.e. the ggtt_view.partial for both normal and partial views. If we
> > allowed garbage into the normal vma->ggtt_view and then try userspace
> > tried to mmap it, we could explode in an unobvious fashion.
> >
> > Fixes: 7b92c047bae2 ("drm/i915: Eliminate superfluous i915_ggtt_view_rotated")
> > Fixes: 3bf4d5751943 ("drm/i915: Stop clearing i915_ggtt_view")
> > Reported-by: Matthew Auld <matthew.william.auld at gmail.com>
> > Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> > Cc: Joonas Lahtinen <joonas.lahtinen at linux.intel.com>
> > Cc: Matthew Auld <matthew.william.auld at gmail.com>
> Tested-by: Matthew Auld <matthew.auld at intel.com>
> Reviewed-by: Matthew Auld <matthew.auld at intel.com>

Thanks for quickly finding this.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre