From c810b079712e2d6e188c679705412953475a1535 Mon Sep 17 00:00:00 2001 From: Alex Deucher Date: Mon, 29 Jul 2024 21:38:53 +0800 Subject: [PATCH] drm/amdkfd: don't allow mapping the MMIO HDP page with large pages mainline inclusion from mainline-v6.9 commit be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAEF52 CVE: CVE-2024-41011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7 -------------------------------- We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap registers. We remap the HDP flush registers into this space to allow userspace (CPU or GPU) to flush the HDP when it updates VRAM. However, on systems with >4K pages, we end up exposing PAGE_SIZE of MMIO space. Fixes: d8e408a82704 ("drm/amdkfd: Expose HDP registers to user space") Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_chardev.c [Commit 73fa13b6a511 ("drm/amdkfd: CRIU Implement KFD restore ioctl") is not merged] Signed-off-by: Zhang Changzhong --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 2a99edf8666e..4155010006b3 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1304,7 +1304,7 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, goto err_unlock; } offset = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); - if (!offset) { + if (!offset || (PAGE_SIZE > 4096)) { err = -ENOMEM; goto err_unlock; } @@ -1962,6 +1962,9 @@ static int kfd_mmio_mmap(struct kfd_dev *dev, struct kfd_process *process, if (vma->vm_end - vma->vm_start != PAGE_SIZE) return -EINVAL; + if (PAGE_SIZE > 4096) + return -EINVAL; + address = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd); vma->vm_flags |= VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE | -- Gitee