From patchwork Fri Nov 22 10:43:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tvrtko Ursulin X-Patchwork-Id: 11257655 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3CA05138C for ; Fri, 22 Nov 2019 10:43:16 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2527820717 for ; Fri, 22 Nov 2019 10:43:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2527820717 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=intel-gfx-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 9B7D16F51D; Fri, 22 Nov 2019 10:43:15 +0000 (UTC) X-Original-To: Intel-gfx@lists.freedesktop.org Delivered-To: Intel-gfx@lists.freedesktop.org Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTPS id 94DE86F50F; Fri, 22 Nov 2019 10:43:14 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga007.jf.intel.com ([10.7.209.58]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Nov 2019 02:43:14 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,229,1571727600"; d="scan'208";a="197584060" Received: from aburk3x-mobl1.ger.corp.intel.com (HELO localhost.localdomain) ([10.252.19.231]) by orsmga007.jf.intel.com with ESMTP; 22 Nov 2019 02:43:13 -0800 From: Tvrtko Ursulin To: igt-dev@lists.freedesktop.org Date: Fri, 22 Nov 2019 10:43:07 +0000 Message-Id: <20191122104307.30412-1-tvrtko.ursulin@linux.intel.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH i-g-t] tests/i915/query: Check no buffer overwrite X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Intel-gfx@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" From: Tvrtko Ursulin Check that the engine query is not polluting the buffer past the size it indicated it would write. Signed-off-by: Tvrtko Ursulin Reviewed-by: Chris Wilson --- tests/i915/i915_query.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/i915/i915_query.c b/tests/i915/i915_query.c index ecbec3ae141d..92dd8f48a5d0 100644 --- a/tests/i915/i915_query.c +++ b/tests/i915/i915_query.c @@ -496,7 +496,8 @@ static void engines_invalid(int fd) { struct drm_i915_query_engine_info *engines; struct drm_i915_query_item item; - unsigned int len; + unsigned int i, len; + char *buf; /* Flags is MBZ. */ memset(&item, 0, sizeof(item)); @@ -574,6 +575,20 @@ static void engines_invalid(int fd) -1, 0); igt_assert(engines != MAP_FAILED); + /* Check no write past len. */ + memset(engines, 0, 4096); + memset(&item, 0, sizeof(item)); + item.query_id = DRM_I915_QUERY_ENGINE_INFO; + item.length = len; + item.data_ptr = to_user_pointer(engines); + i915_query_items(fd, &item, 1); + igt_assert_eq(item.length, len); + buf = (char *)engines; + buf += len; + for (i = 0; i < 4096 - len; i++, buf++) + igt_assert_f(*buf == 0, "Garbage %u bytes after buffer! (%x)\n", + i, *buf); + /* PROT_NONE is similar to unmapped area. */ memset(engines, 0, len); igt_assert_eq(mprotect(engines, len, PROT_NONE), 0);