leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/msm: fix use of copy_from_user() while holding spinlock

Browse Source 
Use instead __copy_from_user_inatomic() and fallback to slow-path where
we drop and re-aquire the lock in case of fault.

Cc: stable@vger.kernel.org
Reported-by: Vaishali Thakkar <vaishali.thakkar@oracle.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
This commit is contained in:
Rob Clark 2016-08-22 15:15:23 -04:00
parent 969af80f77
commit 89f82cbb0d
1 changed files with 22 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
drivers/gpu/drm/msm/msm_gem_submit.c
View File

@ -64,6 +64,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
kfree(submit); kfree(submit);
} }
static inline unsigned long __must_check
copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
{
if (access_ok(VERIFY_READ, from, n))
return __copy_from_user_inatomic(to, from, n);
return -EFAULT;
}
static int submit_lookup_objects(struct msm_gem_submit *submit, static int submit_lookup_objects(struct msm_gem_submit *submit,
struct drm_msm_gem_submit *args, struct drm_file *file) struct drm_msm_gem_submit *args, struct drm_file *file)
{ {
@ -71,6 +79,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
int ret = 0; int ret = 0;
spin_lock(&file->table_lock); spin_lock(&file->table_lock);
pagefault_disable();
for (i = 0; i < args->nr_bos; i++) { for (i = 0; i < args->nr_bos; i++) {
struct drm_msm_gem_submit_bo submit_bo; struct drm_msm_gem_submit_bo submit_bo;
@ -84,10 +93,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
*/ */
submit->bos[i].flags = 0; submit->bos[i].flags = 0;
ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
if (ret) { if (unlikely(ret)) {
ret = -EFAULT; pagefault_enable();
goto out_unlock; spin_unlock(&file->table_lock);
ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
if (ret)
goto out;
spin_lock(&file->table_lock);
pagefault_disable();
} }
if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) { if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@ -127,9 +141,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
} }
out_unlock: out_unlock:
submit->nr_bos = i; pagefault_enable();
spin_unlock(&file->table_lock); spin_unlock(&file->table_lock);
out:
submit->nr_bos = i;
return ret; return ret;
} }