openwrt/target/linux/brcm2708/patches-4.9/950-0182-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch
Stijn Tintel f621b53951 kernel: bump 4.9 to 4.9.82
Refresh patches.
Remove upstreamed patches:
- ar7/002-MIPS-AR7-ensure-the-port-type-s-FCR-value-is-used.patch
- backport/040-crypto-fix-typo-in-KPP-dependency-of-CRYPTO_ECDH.patch
Remove layerscape/819-Revert-dmaengine-dmatest-move-callback-wait-queue-to.patch,
it is superseded by upstream commit 297c7cc4b5651b174a62925b6c961085f04979fd.
Remove pending/650-pppoe_header_pad.patch, it is superseded by
upstream commit 1bd21b158e07e0b8c5a2ce832305a0ebfe42c480.
Update patches that no longer apply:
- ar71xx/004-register_gpio_driver_earlier.patch
- hack/204-module_strip.patch
- pending/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch

Fixes CVE-2017-8824.

Compile-tested: ar71xx.
Runtime-tested: ar71xx.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2018-02-18 02:59:57 +01:00

80 lines
2.2 KiB
Diff

From b280acf3c32746106c81419390f5b1869d644f66 Mon Sep 17 00:00:00 2001
From: Eric Anholt <eric@anholt.net>
Date: Mon, 12 Oct 2015 08:58:08 -0700
Subject: [PATCH] drm/vc4: Verify at boot that CMA doesn't cross a 256MB
boundary.
I've seen lots of users cranking CMA up higher, so throw an error if
they do.
Signed-off-by: Eric Anholt <eric@anholt.net>
---
drivers/base/dma-contiguous.c | 1 +
drivers/gpu/drm/vc4/vc4_v3d.c | 18 ++++++++++++++++++
mm/cma.c | 2 ++
3 files changed, 21 insertions(+)
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -35,6 +35,7 @@
#endif
struct cma *dma_contiguous_default_area;
+EXPORT_SYMBOL(dma_contiguous_default_area);
/*
* Default global CMA area size can be defined in kernel's .config.
--- a/drivers/gpu/drm/vc4/vc4_v3d.c
+++ b/drivers/gpu/drm/vc4/vc4_v3d.c
@@ -16,7 +16,10 @@
* this program. If not, see <http://www.gnu.org/licenses/>.
*/
+#include "linux/init.h"
+#include "linux/cma.h"
#include "linux/component.h"
+#include "linux/dma-contiguous.h"
#include "linux/pm_runtime.h"
#include "vc4_drv.h"
#include "vc4_regs.h"
@@ -188,8 +191,23 @@ static int vc4_v3d_bind(struct device *d
struct drm_device *drm = dev_get_drvdata(master);
struct vc4_dev *vc4 = to_vc4_dev(drm);
struct vc4_v3d *v3d = NULL;
+ struct cma *cma;
int ret;
+ cma = dev_get_cma_area(dev);
+ if (!cma)
+ return -EINVAL;
+
+ if ((cma_get_base(cma) & 0xf0000000) !=
+ ((cma_get_base(cma) + cma_get_size(cma) - 1) & 0xf0000000)) {
+ DRM_ERROR("V3D requires that the CMA area (0x%08lx - 0x%08lx) "
+ "not span a 256MB boundary, or memory corruption "
+ "would happen.\n",
+ (long)cma_get_base(cma),
+ cma_get_base(cma) + cma_get_size(cma));
+ return -EINVAL;
+ }
+
v3d = devm_kzalloc(&pdev->dev, sizeof(*v3d), GFP_KERNEL);
if (!v3d)
return -ENOMEM;
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -47,11 +47,13 @@ phys_addr_t cma_get_base(const struct cm
{
return PFN_PHYS(cma->base_pfn);
}
+EXPORT_SYMBOL(cma_get_base);
unsigned long cma_get_size(const struct cma *cma)
{
return cma->count << PAGE_SHIFT;
}
+EXPORT_SYMBOL(cma_get_size);
static unsigned long cma_bitmap_aligned_mask(const struct cma *cma,
unsigned int align_order)