diff options
| author |   Ping Gao <ping.a.gao@intel.com> | 2017-07-04 16:09:58 +0800 |
|---|---|---|
| committer |   Zhenyu Wang <zhenyuw@linux.intel.com> | 2017-07-11 13:46:58 +0800 |
| commit | 3364bf5fd00f0391ad090f547932a5c4b2068dbc (patch) | |
| tree | fd2d4a63c55ec6535b72959e3259f4e8e0f89ffd /drivers/gpu/drm/i915/gvt/cmd_parser.c | |
| parent | drm/i915/gvt: Fix a memory leak in intel_gvt_init_gtt() (diff) | |
| download | wireguard-linux-3364bf5fd00f0391ad090f547932a5c4b2068dbc.tar.xz wireguard-linux-3364bf5fd00f0391ad090f547932a5c4b2068dbc.zip | |
drm/i915/gvt: Audit the command buffer address
The command buffer address in context like ring buffer base address
and wa_ctx address need to be audit to make sure they are in the
valid GGTT range.
Signed-off-by: Ping Gao <ping.a.gao@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/cmd_parser.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c index 51241de5e7a7..713848c36349 100644 --- a/drivers/gpu/drm/i915/gvt/cmd_parser.c +++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c @@ -2536,6 +2536,11 @@ static int scan_workload(struct intel_vgpu_workload *workload) gma_head == gma_tail) return 0; + if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) { + ret = -EINVAL; + goto out; + } + ret = ip_gma_set(&s, gma_head); if (ret) goto out; @@ -2579,6 +2584,11 @@ static int scan_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx) s.rb_va = wa_ctx->indirect_ctx.shadow_va; s.workload = workload; + if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) { + ret = -EINVAL; + goto out; + } + ret = ip_gma_set(&s, gma_head); if (ret) goto out; |