Skip to content

Commit 0829b5b

Browse files
Tvrtko Ursulintursulin
authored andcommitted
drm/i915: 2 GiB of relocations ought to be enough for anybody*
Kernel test robot reports i915 can hit a warn in kvmalloc_node which has a purpose of dissalowing crazy size kernel allocations. This was added in 7661809 ("mm: don't allow oversized kvmalloc() calls"): /* Don't even allow crazy sizes */ if (WARN_ON_ONCE(size > INT_MAX)) return NULL; This would be kind of okay since i915 at one point dropped the need for making a shadow copy of the relocation list, but then it got re-added in fd1500f ("Revert "drm/i915/gem: Drop relocation slowpath".") a year after Linus added the above warning. It is plausible that the issue was not seen until now because to trigger gem_exec_reloc test requires a combination of an relatively older generation hardware but with at least 8GiB of RAM installed. Probably even more depending on runtime checks. Lets cap what we allow userspace to pass in using the matching limit. There should be no issue for real userspace since we are talking about "crazy" number of relocations which have no practical purpose. *) Well IGT tests might get upset but they can be easily adjusted. Signed-off-by: Tvrtko Ursulin <[email protected]> Reported-by: kernel test robot <[email protected]> Closes: https://lore.kernel.org/oe-lkp/[email protected] Cc: Kees Cook <[email protected]> Cc: Kent Overstreet <[email protected]> Cc: Joonas Lahtinen <[email protected]> Cc: Rodrigo Vivi <[email protected]> Reviewed-by: Kees Cook <[email protected]> Reviewed-by: Joonas Lahtinen <[email protected]> Signed-off-by: Tvrtko Ursulin <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
1 parent 92653f2 commit 0829b5b

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1533,7 +1533,7 @@ static int eb_relocate_vma(struct i915_execbuffer *eb, struct eb_vma *ev)
15331533
u64_to_user_ptr(entry->relocs_ptr);
15341534
unsigned long remain = entry->relocation_count;
15351535

1536-
if (unlikely(remain > N_RELOC(ULONG_MAX)))
1536+
if (unlikely(remain > N_RELOC(INT_MAX)))
15371537
return -EINVAL;
15381538

15391539
/*
@@ -1641,7 +1641,7 @@ static int check_relocations(const struct drm_i915_gem_exec_object2 *entry)
16411641
if (size == 0)
16421642
return 0;
16431643

1644-
if (size > N_RELOC(ULONG_MAX))
1644+
if (size > N_RELOC(INT_MAX))
16451645
return -EINVAL;
16461646

16471647
addr = u64_to_user_ptr(entry->relocs_ptr);

0 commit comments

Comments
 (0)