| Message ID | 20200806143536.16012-1-chris@chris-wilson.co.uk (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915/selftests: Prevent selecting 0 for our random width/align | expand |
Quoting Chris Wilson (2020-08-06 15:35:36) > When igt_random_offset() is a given a range of [0, PAGE_SIZE], it is > allowed to return 0. However, attempting to use a size of 0 for the > igt_lmem_write_cpu() byte poking, leads to call igt_random_offset() with > a range of [offset, offset + 0] and ask it to find a length of 4 within > it. This triggers the bug on that the requested length should fit within > the range! > > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: Matthew Auld <matthew.auld@intel.com> > --- > I feel into the same trap of not fixing up the random return of 0 > --- > drivers/gpu/drm/i915/selftests/intel_memory_region.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/i915/selftests/intel_memory_region.c b/drivers/gpu/drm/i915/selftests/intel_memory_region.c > index 6e80d99048e4..54e683bb220b 100644 > --- a/drivers/gpu/drm/i915/selftests/intel_memory_region.c > +++ b/drivers/gpu/drm/i915/selftests/intel_memory_region.c > @@ -522,9 +522,10 @@ static int igt_lmem_write_cpu(void *arg) > goto out_unpin; > } > > - /* We want to throw in a random width/align */ > - bytes[0] = igt_random_offset(&prng, 0, PAGE_SIZE, sizeof(u32), > - sizeof(u32)); > + /* A random multiple of u32, picked between [64, PAGE_SIZE - 64] */ > + bytes[0] = 1 + prandom_u32_state(&prng); But what about if it returns -1. Gah. -Chris
diff --git a/drivers/gpu/drm/i915/selftests/intel_memory_region.c b/drivers/gpu/drm/i915/selftests/intel_memory_region.c index 6e80d99048e4..54e683bb220b 100644 --- a/drivers/gpu/drm/i915/selftests/intel_memory_region.c +++ b/drivers/gpu/drm/i915/selftests/intel_memory_region.c @@ -522,9 +522,10 @@ static int igt_lmem_write_cpu(void *arg) goto out_unpin; } - /* We want to throw in a random width/align */ - bytes[0] = igt_random_offset(&prng, 0, PAGE_SIZE, sizeof(u32), - sizeof(u32)); + /* A random multiple of u32, picked between [64, PAGE_SIZE - 64] */ + bytes[0] = 1 + prandom_u32_state(&prng); + bytes[0] = round_up(bytes[0], 64) & (PAGE_SIZE - 1); + GEM_BUG_ON(!IS_ALIGNED(bytes[0], sizeof(u32))); i = 0; do {
When igt_random_offset() is a given a range of [0, PAGE_SIZE], it is allowed to return 0. However, attempting to use a size of 0 for the igt_lmem_write_cpu() byte poking, leads to call igt_random_offset() with a range of [offset, offset + 0] and ask it to find a length of 4 within it. This triggers the bug on that the requested length should fit within the range! Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Matthew Auld <matthew.auld@intel.com> --- I feel into the same trap of not fixing up the random return of 0 --- drivers/gpu/drm/i915/selftests/intel_memory_region.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)