diff options
| author | Jani Nikula <jani.nikula@intel.com> | 2018-06-07 12:06:07 +0300 |
|---|---|---|
| committer | Jani Nikula <jani.nikula@intel.com> | 2018-06-07 12:06:07 +0300 |
| commit | 807cba6559cf333a74df1fbd74f0597e8e7fa020 (patch) | |
| tree | b5f5260dd10caa3a9870b97ee4b86bda57d87d66 /drivers/gpu/drm/i915/gvt/handlers.c | |
| parent | 197af5f2131101f9a6118b238901cb1988f5d7f9 (diff) | |
| parent | 39b4cbadb9a95bf3f13ea102d6ec841940916ee2 (diff) | |
| download | linux-807cba6559cf333a74df1fbd74f0597e8e7fa020.tar.xz | |
Merge tag 'gvt-fixes-2018-04-19' of https://github.com/intel/gvt-linux into drm-intel-next-fixes
gvt-fixes-2018-04-19
- cmd parser error path mem leak fix (Colin)
- fix dp aux header validation (Changbin)
- sanity check on pfn after vfio pin page (Changbin)
- fix msi eventfd put (Xiong)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180419073948.4mojv7xaxxvfuyud@zhen-hp.sh.intel.com
Diffstat (limited to 'drivers/gpu/drm/i915/gvt/handlers.c')
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/handlers.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c index 4b6532fb789a..bcbc47a88a70 100644 --- a/drivers/gpu/drm/i915/gvt/handlers.c +++ b/drivers/gpu/drm/i915/gvt/handlers.c @@ -903,11 +903,14 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu, } /* - * Write request format: (command + address) occupies - * 3 bytes, followed by (len + 1) bytes of data. + * Write request format: Headr (command + address + size) occupies + * 4 bytes, followed by (len + 1) bytes of data. See details at + * intel_dp_aux_transfer(). */ - if (WARN_ON((len + 4) > AUX_BURST_SIZE)) + if ((len + 1 + 4) > AUX_BURST_SIZE) { + gvt_vgpu_err("dp_aux_header: len %d is too large\n", len); return -EINVAL; + } /* unpack data from vreg to buf */ for (t = 0; t < 4; t++) { @@ -971,8 +974,10 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu, /* * Read reply format: ACK (1 byte) plus (len + 1) bytes of data. */ - if (WARN_ON((len + 2) > AUX_BURST_SIZE)) + if ((len + 2) > AUX_BURST_SIZE) { + gvt_vgpu_err("dp_aux_header: len %d is too large\n", len); return -EINVAL; + } /* read from virtual DPCD to vreg */ /* first 4 bytes: [ACK][addr][addr+1][addr+2] */ |