diff options
| author | Christian König <christian.koenig@amd.com> | 2016-06-29 14:26:41 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2016-07-07 22:06:09 +0300 |
| commit | b5f5acbc87052e1bd8ada6915e1dedd856da767d (patch) | |
| tree | 0892fd1a08ab03f5ff5fc074685c8294ba34166f /drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | |
| parent | 566281595037a6f5932adbf8e04d3a63e7687fd7 (diff) | |
| download | linux-b5f5acbc87052e1bd8ada6915e1dedd856da767d.tar.xz | |
drm/amdgpu: fix user fence handling once more
Same problem as with the VM page tables. The user fence address must be
determined before the job is scheduled, not when the IB is executed.
This fixes a security problem where user fences could be used to overwrite
any part of VRAM.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Chunming Zhou <david1.zhou@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c index 34e35423b78e..0bf6c1b330be 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c @@ -203,11 +203,8 @@ int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned num_ibs, } /* wrap the last IB with fence */ - if (job && job->uf_bo) { - uint64_t addr = amdgpu_bo_gpu_offset(job->uf_bo); - - addr += job->uf_offset; - amdgpu_ring_emit_fence(ring, addr, job->uf_sequence, + if (job && job->uf_addr) { + amdgpu_ring_emit_fence(ring, job->uf_addr, job->uf_sequence, AMDGPU_FENCE_FLAG_64BIT); } |