47 lines
1.9 KiB
Diff
47 lines
1.9 KiB
Diff
From 480a45da3aa4d8b3e252c6b18181985ab27ac647 Mon Sep 17 00:00:00 2001
|
|
From: Vivek Veenam <[email protected]>
|
|
Date: Tue, 10 Oct 2023 09:36:05 +0000
|
|
Subject: [PATCH] GPUCORE-39913 Fix the OOB write in mmu_insert_pages_failure_recovery()
|
|
|
|
In the failure recovery path of the mmu_insert_pages_no_flush() the
|
|
phys pointer passed to mmu_insert_pages_failure_recovery() is incremented
|
|
and not the original value. Dereferencing it can lead to a OOB write access.
|
|
To fix this issue we are passing the original value of the phys pointer
|
|
in the call to the mmu_insert_pages_failure_recovery().
|
|
|
|
TI2: 1070009 (PLAN-11965r938 DDK Precommit)
|
|
|
|
Change-Id: I5fe0ad39fc7dfd00b087b70275b8ab56185cfec8
|
|
---
|
|
|
|
diff --git a/product/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c b/product/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c
|
|
index b82949b..7a66b88c 100644
|
|
--- a/product/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c
|
|
+++ b/product/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c
|
|
@@ -1797,7 +1797,7 @@
|
|
* movable once they are returned to a memory pool.
|
|
*/
|
|
if (kbase_is_page_migration_enabled() && !ignore_page_migration && phys) {
|
|
- const u64 num_pages = to_vpfn - from_vpfn + 1;
|
|
+ const u64 num_pages = to_vpfn - from_vpfn;
|
|
u64 i;
|
|
|
|
for (i = 0; i < num_pages; i++) {
|
|
@@ -2345,6 +2345,7 @@
|
|
unsigned int i;
|
|
phys_addr_t new_pgds[MIDGARD_MMU_BOTTOMLEVEL + 1];
|
|
int l, cur_level, insert_level;
|
|
+ struct tagged_addr *start_phys = phys;
|
|
|
|
/* Note that 0 is a valid start_vpfn */
|
|
/* 64-bit address range is the max */
|
|
@@ -2511,7 +2512,7 @@
|
|
if (insert_vpfn != start_vpfn) {
|
|
/* Invalidate the pages we have partially completed */
|
|
mmu_insert_pages_failure_recovery(kbdev, mmut, start_vpfn, insert_vpfn, dirty_pgds,
|
|
- phys, ignore_page_migration);
|
|
+ start_phys, ignore_page_migration);
|
|
}
|
|
|
|
mmu_flush_invalidate_insert_pages(kbdev, mmut, start_vpfn, nr,
|