diff options
| author |   Aleksei Gimbitskii <aleksei.gimbitskii@intel.com> | 2019-04-23 15:04:13 +0300 |
|---|---|---|
| committer |   Zhenyu Wang <zhenyuw@linux.intel.com> | 2019-04-25 15:36:29 +0800 |
| commit | 930c8dfea4b8f320bd7f6a3e5e721ac20e444e03 (patch) | |
| tree | 7b506968128d833bdcfcba2c10a2a22655ba6c51 /drivers/gpu/drm/i915/gvt | |
| parent | drm/i915/gvt: Use snprintf() to prevent possible buffer overflow. (diff) | |
| download | linux-dev-930c8dfea4b8f320bd7f6a3e5e721ac20e444e03.tar.xz linux-dev-930c8dfea4b8f320bd7f6a3e5e721ac20e444e03.zip | |
drm/i915/gvt: Check if get_next_pt_type() always returns a valid value
According to gtt_type_table[] function get_next_pt_type() may returns
GTT_TYPE_INVALID in some cases. To prevent driver to try to create memory
page with invalid data type, additional check is added.
Signed-off-by: Aleksei Gimbitskii <aleksei.gimbitskii@intel.com>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: Zhi Wang <zhi.a.wang@intel.com>
Cc: Colin Xu <colin.xu@intel.com>
Reviewed-by: Colin Xu <colin.xu@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Diffstat (limited to 'drivers/gpu/drm/i915/gvt')
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/gtt.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index 7600416db908..08c74e65836b 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -1076,6 +1076,9 @@ static struct intel_vgpu_ppgtt_spt *ppgtt_populate_spt_by_guest_entry( } else { int type = get_next_pt_type(we->type); + if (!gtt_type_is_pt(type)) + goto err; + spt = ppgtt_alloc_spt_gfn(vgpu, type, ops->get_pfn(we), ips); if (IS_ERR(spt)) { ret = PTR_ERR(spt); |