Closed Tahaan closed 5 months ago
The below commit seem to be to blame
johan@fedora ~/e/module (main) [128]> git log -p evdi_gem.c
commit 294af3d4ec5b22012174a3b26b773f939dad7dbd
Author: Łukasz Spintzyk <lukasz.spintzyk@synaptics.com>
Date: Wed Sep 6 07:49:36 2023 +0200
Fix possible OOB in evdi_gem_fault
diff --git a/module/evdi_gem.c b/module/evdi_gem.c
index 499d065..efae6e1 100644
--- a/module/evdi_gem.c
+++ b/module/evdi_gem.c
@@ -205,12 +205,13 @@ int evdi_gem_fault(struct vm_fault *vmf)
#endif
struct evdi_gem_object *obj = to_evdi_bo(vma->vm_private_data);
struct page *page;
- unsigned int page_offset;
+ pgoff_t page_offset;
+ loff_t num_pages = obj->base.size >> PAGE_SHIFT;
int ret = 0;
page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
- if (!obj->pages)
+ if (!obj->pages || page_offset >= num_pages)
return VM_FAULT_SIGBUS;
page = obj->pages[page_offset];
I also ran into this. I'm not sure if this is the right way to handle this, but I worked around it with the following. I cast, what I think is the smaller type of pgoff_t
(long unsigned int
) to the larger signed loff_t
(long long int
)
diff --git a/module/evdi_gem.c b/module/evdi_gem.c
index efae6e1..46dc5fa 100644
--- a/module/evdi_gem.c
+++ b/module/evdi_gem.c
@@ -211,7 +211,7 @@ int evdi_gem_fault(struct vm_fault *vmf)
page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
- if (!obj->pages || page_offset >= num_pages)
+ if (!obj->pages || (loff_t)page_offset >= num_pages)
return VM_FAULT_SIGBUS;
page = obj->pages[page_offset];
@tanj the same Issue still occurs on Pop_OS! (kernel 6.8.0)
/my/directory/path/evdi/module/evdi_gem.c: In function ‘evdi_gem_fault’: /my/directory/path/evdi/module/evdi_gem.c:214:40: error: comparison of integer expressions of different signedness: ‘long unsigned int’ and ‘loff_t’ {aka ‘long long int’} [-Werror=sign-compare] 214 | if (!obj->pages || page_offset >= num_pages) | ^~ cc1: all warnings being treated as errors make[4]: [scripts/Makefile.build:243: /my/directory/path/evdi/module/evdi_gem.o] Error 1 make[3]: [/usr/src/linux-headers-6.8.0-76060800daily20240311-generic/Makefile:1927: /my/directory/path/evdi/module] Error 2 make[2]: [Makefile:240: __sub-make] Error 2 make[2]: Leaving directory '/usr/src/linux-headers-6.8.0-76060800daily20240311-generic' make[1]: [Makefile:86: module] Error 2 make[1]: Leaving directory '/my/directory/path/evdi/module' make: *** [Makefile:13: module] Error 2
Fixed in 1.14.3
Are you using the latest driver?
Are you using the latest EVDI version?
nothing to commit, working tree clean johan@fedora ~/evdi (main)> git log -1 commit 9905b9bfed8b7e49befa0530bfb6e464380d938f (HEAD -> main, tag: v1.14.2, origin/main, origin/HEAD) Author: Łukasz Spintzyk lukasz.spintzyk@synaptics.com Date: Wed Jan 31 11:30:22 2024 +0100
johan@fedora ~/evdi (main)>
johan@fedora ~/evdi (main)> uname -a Linux fedora 6.7.9-200.fc39.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Mar 6 19:35:04 UTC 2024 x86_64 GNU/Linux
johan@fedora ~/evdi (main)> make CFLAGS="-isystem./include -isystem./include/uapi -Werror -Wextra -Wall -Wno-error=missing-field-initializers -Werror=sign-compare -Wmissing-prototypes -Wstrict-prototypes -Werror=discarded-qualifiers " make -C module make[1]: Entering directory '/home/johan/evdi/module' make -C /lib/modules/6.7.9-200.fc39.x86_64/build M=$PWD make[2]: Entering directory '/usr/src/kernels/6.7.9-200.fc39.x86_64' warning: the compiler differs from the one used to build the kernel The kernel was built by: gcc (GCC) 13.2.1 20231205 (Red Hat 13.2.1-6) You are using: gcc (GCC) 13.2.1 20240316 (Red Hat 13.2.1-7) CC [M] /home/johan/evdi/module/evdi_platform_drv.o CC [M] /home/johan/evdi/module/evdi_platform_dev.o CC [M] /home/johan/evdi/module/evdi_sysfs.o CC [M] /home/johan/evdi/module/evdi_modeset.o CC [M] /home/johan/evdi/module/evdi_connector.o CC [M] /home/johan/evdi/module/evdi_encoder.o CC [M] /home/johan/evdi/module/evdi_drm_drv.o CC [M] /home/johan/evdi/module/evdi_fb.o CC [M] /home/johan/evdi/module/evdi_gem.o /home/johan/evdi/module/evdi_gem.c: In function ‘evdi_gem_fault’: /home/johan/evdi/module/evdi_gem.c:214:40: error: comparison of integer expressions of different signedness: ‘long unsigned int’ and ‘loff_t’ {aka ‘long long int’} [-Werror=sign-compare] 214 | if (!obj->pages || page_offset >= num_pages) | ^~ cc1: all warnings being treated as errors make[4]: [scripts/Makefile.build:243: /home/johan/evdi/module/evdi_gem.o] Error 1 make[3]: [/usr/src/kernels/6.7.9-200.fc39.x86_64/Makefile:1929: /home/johan/evdi/module] Error 2 make[2]: [Makefile:246: __sub-make] Error 2 make[2]: Leaving directory '/usr/src/kernels/6.7.9-200.fc39.x86_64' make[1]: [Makefile:86: module] Error 2 make[1]: Leaving directory '/home/johan/evdi/module' make: *** [Makefile:13: module] Error 2