ExternalVendorCode/genode
1
0
Fork 0
mirror of https://github.com/genodelabs/genode.git synced 2024-12-24 07:46:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

gpu/intel: deny virtual address above 1 << 48

Browse Source 
commit avoids memory corruption in the ppgtt page insertion code

Issue #4148 #4233
This commit is contained in:
Alexander Boettcher 2021-06-25 16:23:46 +02:00 committed by Christian Helmuth
parent 4b653fbac1
commit 067b7d7c67
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
repos/os/src/drivers/gpu/intel/ppgtt.h
View File

@ -226,6 +226,7 @@ class Genode::Level_4_translation_table
static constexpr size_t PAGE_MASK = ~((1UL << PAGE_SIZE_LOG2) - 1);
class Misaligned {};
class Invalid_address {};
class Invalid_range {};
class Double_insertion {};
@ -309,6 +310,9 @@ class Genode::Level_4_translation_table
addr_t end = (vo + PAGE_SIZE) & PAGE_MASK;
size_t sz = min(size, end-vo);
if (i >= MAX_ENTRIES)
throw Invalid_address();
func(vo, pa, sz, _entries[i]);
/* check whether we wrap */
@ -398,6 +402,7 @@ class Genode::Page_directory
static constexpr size_t PAGE_MASK = ~((1UL << PAGE_SIZE_LOG2) - 1);
class Misaligned {};
class Invalid_address {};
class Invalid_range {};
class Double_insertion {};
@ -563,6 +568,9 @@ class Genode::Page_directory
addr_t end = (vo + PAGE_SIZE) & PAGE_MASK;
size_t sz = min(size, end-vo);
if (i >= MAX_ENTRIES)
throw Invalid_address();
func(vo, pa, sz, _entries[i]);
/* check whether we wrap */
@ -649,6 +657,7 @@ class Genode::Pml4_table
static constexpr uint64_t PAGE_MASK = ~((1ULL << PAGE_SIZE_LOG2) - 1);
class Misaligned {};
class Invalid_address {};
class Invalid_range {};
struct Descriptor : Common_descriptor
@ -746,9 +755,13 @@ class Genode::Pml4_table
{
for (size_t i = vo >> PAGE_SIZE_LOG2; size > 0;
i = vo >> PAGE_SIZE_LOG2) {
addr_t const end = (vo + PAGE_SIZE) & PAGE_MASK;
size_t const sz = min(size, end-vo);
if (i >= MAX_ENTRIES)
throw Invalid_address();
func(vo, pa, sz, _entries[i]);
/* check whether we wrap */