diff options
| author | Ping Gao <ping.a.gao@intel.com> | 2017-07-04 11:09:58 +0300 |
|---|---|---|
| committer | Zhenyu Wang <zhenyuw@linux.intel.com> | 2017-07-11 08:46:58 +0300 |
| commit | 3364bf5fd00f0391ad090f547932a5c4b2068dbc (patch) | |
| tree | fd2d4a63c55ec6535b72959e3259f4e8e0f89ffd | |
| parent | 0de98709896d9c02ce3121ec3afb524253a5853f (diff) | |
| download | linux-3364bf5fd00f0391ad090f547932a5c4b2068dbc.tar.xz | |
drm/i915/gvt: Audit the command buffer address
The command buffer address in context like ring buffer base address
and wa_ctx address need to be audit to make sure they are in the
valid GGTT range.
Signed-off-by: Ping Gao <ping.a.gao@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/cmd_parser.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c index 51241de5e7a7..713848c36349 100644 --- a/drivers/gpu/drm/i915/gvt/cmd_parser.c +++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c @@ -2536,6 +2536,11 @@ static int scan_workload(struct intel_vgpu_workload *workload) gma_head == gma_tail) return 0; + if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) { + ret = -EINVAL; + goto out; + } + ret = ip_gma_set(&s, gma_head); if (ret) goto out; @@ -2579,6 +2584,11 @@ static int scan_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx) s.rb_va = wa_ctx->indirect_ctx.shadow_va; s.workload = workload; + if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) { + ret = -EINVAL; + goto out; + } + ret = ip_gma_set(&s, gma_head); if (ret) goto out; |