From patchwork Wed Apr 22 16:45:11 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mika Kuoppala X-Patchwork-Id: 6256931 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 3E4679F1C4 for ; Wed, 22 Apr 2015 16:45:45 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 6DA0F20320 for ; Wed, 22 Apr 2015 16:45:44 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 85B8F200F0 for ; Wed, 22 Apr 2015 16:45:43 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id F05CF6E437; Wed, 22 Apr 2015 09:45:42 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by gabe.freedesktop.org (Postfix) with ESMTP id B625A6E437 for ; Wed, 22 Apr 2015 09:45:41 -0700 (PDT) Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga103.fm.intel.com with ESMTP; 22 Apr 2015 09:45:41 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.11,624,1422950400"; d="scan'208";a="699262970" Received: from rosetta.fi.intel.com (HELO rosetta) ([10.237.72.78]) by fmsmga001.fm.intel.com with ESMTP; 22 Apr 2015 09:45:39 -0700 Received: by rosetta (Postfix, from userid 1000) id 1053E80057; Wed, 22 Apr 2015 19:45:38 +0300 (EEST) From: Mika Kuoppala To: torvalds@linux-foundation.org, daniel.vetter@intel.com, jani.nikula@linux.intel.com, airlied@linux.ie, ben@bwidawsk.net Date: Wed, 22 Apr 2015 19:45:11 +0300 Message-Id: <1429721111-22845-1-git-send-email-mika.kuoppala@intel.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: References: Cc: intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [Intel-gfx] [PATCH] drm/i915: Add checks to i915_bind_vma X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The current aliasing ppgtt implementation allocates the page table structures on driver initialization for the entire vm address space. Earlier the page tables were allocated as array of struct pages, but introduction of dynamic allocation of page structures changed the page tables to be inside a page directory. We have a detailed bug report where traversing of tables and deferencing page_table[pte]->page oopses. This indicates that our pre allocation of page tables has failed or that we get corrupt vma which does not fit inside the vm area and throws pte > 511. Add more checks to catch the latter. Warn and bail out if we get vma which is out of bounds for binding. v2: Check vma node early (Chris) Cc: Linus Torvalds Cc: Chris Wilson Cc: Michel Thierry Signed-off-by: Mika Kuoppala Tested-By: Intel Graphics QA PRTS (Patch Regression Test System Contact: shuang.he@intel.com) --- drivers/gpu/drm/i915/i915_gem_gtt.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c index 0239fbf..2ffa8f6 100644 --- a/drivers/gpu/drm/i915/i915_gem_gtt.c +++ b/drivers/gpu/drm/i915/i915_gem_gtt.c @@ -2746,6 +2746,13 @@ i915_get_ggtt_vma_pages(struct i915_vma *vma) int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level, u32 flags) { + + if (WARN_ON(!drm_mm_node_allocated(&vma->node))) + return -EINVAL; + + if (WARN_ON(vma->node.start > vma->vm->total - vma->node.size)) + return -EINVAL; + if (i915_is_ggtt(vma->vm)) { int ret = i915_get_ggtt_vma_pages(vma);