diff options
| author | John Harrison <John.C.Harrison@Intel.com> | 2022-03-02 03:33:57 +0300 |
|---|---|---|
| committer | John Harrison <John.C.Harrison@Intel.com> | 2022-03-04 02:03:12 +0300 |
| commit | e1dd871442c05ad5f53bc1eac22f71b53eb48a8a (patch) | |
| tree | a535592aedfef9adbe23331262d07c1f7d6e5720 | |
| parent | d4de9a3eaede440717244672ddc16114e388bc2f (diff) | |
| download | linux-e1dd871442c05ad5f53bc1eac22f71b53eb48a8a.tar.xz | |
drm/i915/guc: Fix potential invalid pointer dereferences when decoding G2Hs
Some G2H handlers were reading the context id field from the payload
before checking the payload met the minimum length required.
Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220302003357.4188363-9-John.C.Harrison@Intel.com
| -rw-r--r-- | drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c index e224e6dafcd0..9d8a271b7a24 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c @@ -3895,12 +3895,13 @@ int intel_guc_deregister_done_process_msg(struct intel_guc *guc, u32 len) { struct intel_context *ce; - u32 ctx_id = msg[0]; + u32 ctx_id; if (unlikely(len < 1)) { drm_err(&guc_to_gt(guc)->i915->drm, "Invalid length %u\n", len); return -EPROTO; } + ctx_id = msg[0]; ce = g2h_context_lookup(guc, ctx_id); if (unlikely(!ce)) @@ -3946,12 +3947,13 @@ int intel_guc_sched_done_process_msg(struct intel_guc *guc, { struct intel_context *ce; unsigned long flags; - u32 ctx_id = msg[0]; + u32 ctx_id; if (unlikely(len < 2)) { drm_err(&guc_to_gt(guc)->i915->drm, "Invalid length %u\n", len); return -EPROTO; } + ctx_id = msg[0]; ce = g2h_context_lookup(guc, ctx_id); if (unlikely(!ce)) |