[PATCH] drm/i915/execbuf: don't allow zero batch_len

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



As per the ABI batch_len is u32, however if the batch_len is left unset,
then the kernel will just assume batch_len is the size of the whole
batch object, however since the vma->size is u64, while the batch_len is
just u32 we can end up with batch_len = 0 if we are given too large batch
object(e.g 1ULL << 32), which doesn't look the intended behaviour and
probably leads to explosions on some HW.

Testcase: igt/gem_exec_params/larger-than-life-batch
Fixes: 0b5372727be3 ("drm/i915/cmdparser: Use cached vmappings")
Signed-off-by: Matthew Auld <matthew.auld@xxxxxxxxx>
Cc: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 4b09bcd70cf4..80c738c72e6e 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -869,8 +869,13 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
 		return -EINVAL;
 	}
 
-	if (eb->batch_len == 0)
+	if (eb->batch_len == 0) {
 		eb->batch_len = eb->batch->vma->size - eb->batch_start_offset;
+		if (unlikely(eb->batch_len == 0)) {
+			drm_dbg(&i915->drm, "Attempting to use too large batch\n");
+			return -EINVAL;
+		}
+	}
 
 	return 0;
 
-- 
2.26.2

_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/intel-gfx



[Index of Archives]     [AMD Graphics]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux