From patchwork Tue Sep 15 22:23:18 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 47773 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n8FMO4vL010283 for ; Tue, 15 Sep 2009 22:24:04 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 833689E7F4; Tue, 15 Sep 2009 15:24:04 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from relay.fireflyinternet.com (unknown [66.98.244.53]) by gabe.freedesktop.org (Postfix) with ESMTP id DBAF09E78C for ; Tue, 15 Sep 2009 15:24:02 -0700 (PDT) Received: from fireflyinternet.com (unverified [94.30.43.99]) by relay.fireflyinternet.com (FireflyRelay1) with ESMTP id 49880917 for ; Tue, 15 Sep 2009 23:24:05 +0100 Received: from localhost.localdomain (unverified [78.156.66.37]) by fireflyinternet.com (Firefly Internet SMTP) with ESMTP id 51717915-1948518 for multiple; Tue, 15 Sep 2009 23:23:52 +0100 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Tue, 15 Sep 2009 23:23:18 +0100 Message-Id: <1253053398-11905-1-git-send-email-chris@chris-wilson.co.uk> X-Mailer: git-send-email 1.6.3.3 In-Reply-To: <1252527315-12803-1-git-send-email-chris@chris-wilson.co.uk> References: <1252527315-12803-1-git-send-email-chris@chris-wilson.co.uk> X-Originating-IP: 78.156.66.37 Cc: stable@kernel.org Subject: [Intel-gfx] [PATCH 1/2] drm/i915: Check that the relocation points to within the target X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org Eric noted a potential concern with the low bits not being strictly used as part of the absolute offset (instead part of the command stream to the GPU), but in practice that should not be an issue. Signed-off-by: Chris Wilson Tested-by: Andy Whitcroft Cc: Eric Anholt CC: stable@kernel.org --- drivers/gpu/drm/i915/i915_gem.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index e0da986..11242c6 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3004,6 +3004,16 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj, return -EINVAL; } + if (reloc->delta >= target_obj->size) { + DRM_ERROR("Relocation beyond target object bounds: " + "obj %p target %d delta %d size %d.\n", + obj, reloc->target_handle, + (int) reloc->delta, (int) target_obj->size); + drm_gem_object_unreference(target_obj); + i915_gem_object_unpin(obj); + return -EINVAL; + } + if (reloc->write_domain & I915_GEM_DOMAIN_CPU || reloc->read_domains & I915_GEM_DOMAIN_CPU) { DRM_ERROR("reloc with read/write CPU domains: "