Hi Greg,
attached is a backport of this fix to 4.14.
On 2017-12-04 12:55 PM, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
>
> The patch below does not apply to the 4.14-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@xxxxxxxxxxxxxxx>.
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
>>From fa7c7939b4bf112cd06ba166b739244077898990 Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@xxxxxxx>
> Date: Wed, 22 Nov 2017 15:55:21 +0100
> Subject: [PATCH] drm/amdgpu: Use unsigned ring indices in amdgpu_queue_mgr_map
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
>
> This matches the corresponding UAPI fields. Treating the ring index as
> signed could result in accessing random unrelated memory if the MSB was
> set.
>
> Fixes: effd924d2f3b ("drm/amdgpu: untie user ring ids from kernel ring
> ids v6")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Alex Deucher <alexander.deucher@xxxxxxx>
> Reviewed-by: Christian König <christian.koenig@xxxxxxx>
> Signed-off-by: Michel Dänzer <michel.daenzer@xxxxxxx>
> Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
> index c25cedff4915..0b14b5373783 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
> @@ -717,7 +717,7 @@ int amdgpu_queue_mgr_fini(struct amdgpu_device *adev,
> struct amdgpu_queue_mgr *mgr);
> int amdgpu_queue_mgr_map(struct amdgpu_device *adev,
> struct amdgpu_queue_mgr *mgr,
> - int hw_ip, int instance, int ring,
> + u32 hw_ip, u32 instance, u32 ring,
> struct amdgpu_ring **out_ring);
>
> /*
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
> index 190e28cb827e..93d86619e802 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
> @@ -63,7 +63,7 @@ static int amdgpu_update_cached_map(struct amdgpu_queue_mapper *mapper,
>
> static int amdgpu_identity_map(struct amdgpu_device *adev,
> struct amdgpu_queue_mapper *mapper,
> - int ring,
> + u32 ring,
> struct amdgpu_ring **out_ring)
> {
> switch (mapper->hw_ip) {
> @@ -121,7 +121,7 @@ static enum amdgpu_ring_type amdgpu_hw_ip_to_ring_type(int hw_ip)
>
> static int amdgpu_lru_map(struct amdgpu_device *adev,
> struct amdgpu_queue_mapper *mapper,
> - int user_ring, bool lru_pipe_order,
> + u32 user_ring, bool lru_pipe_order,
> struct amdgpu_ring **out_ring)
> {
> int r, i, j;
> @@ -208,7 +208,7 @@ int amdgpu_queue_mgr_fini(struct amdgpu_device *adev,
> */
> int amdgpu_queue_mgr_map(struct amdgpu_device *adev,
> struct amdgpu_queue_mgr *mgr,
> - int hw_ip, int instance, int ring,
> + u32 hw_ip, u32 instance, u32 ring,
> struct amdgpu_ring **out_ring)
> {
> int r, ip_num_rings;
>
--
Earthling Michel Dänzer | http://www.amd.com
Libre software enthusiast | Mesa and X developer
From 8ef715dfa2e1b71faf7a12da35a645a72bca9d44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@xxxxxxx>
Date: Mon, 4 Dec 2017 18:41:49 +0100
Subject: [PATCH] drm/amdgpu: Use unsigned ring indices in amdgpu_queue_mgr_map
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This matches the corresponding UAPI fields. Treating the ring index as
signed could result in accessing random unrelated memory if the MSB was
set.
Fixes: effd924d2f3b ("drm/amdgpu: untie user ring ids from kernel ring
ids v6")
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Alex Deucher <alexander.deucher@xxxxxxx>
Reviewed-by: Christian König <christian.koenig@xxxxxxx>
Signed-off-by: Michel Dänzer <michel.daenzer@xxxxxxx>
Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
(Cherry picked from commit fa7c7939b4bf112cd06ba166b739244077898990)
---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 103635ab784c..3ab63101791d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -697,7 +697,7 @@ int amdgpu_queue_mgr_fini(struct amdgpu_device *adev,
struct amdgpu_queue_mgr *mgr);
int amdgpu_queue_mgr_map(struct amdgpu_device *adev,
struct amdgpu_queue_mgr *mgr,
- int hw_ip, int instance, int ring,
+ u32 hw_ip, u32 instance, u32 ring,
struct amdgpu_ring **out_ring);
/*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
index befc09b68543..b293380bd46c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
@@ -63,7 +63,7 @@ static int amdgpu_update_cached_map(struct amdgpu_queue_mapper *mapper,
static int amdgpu_identity_map(struct amdgpu_device *adev,
struct amdgpu_queue_mapper *mapper,
- int ring,
+ u32 ring,
struct amdgpu_ring **out_ring)
{
switch (mapper->hw_ip) {
@@ -121,7 +121,7 @@ static enum amdgpu_ring_type amdgpu_hw_ip_to_ring_type(int hw_ip)
static int amdgpu_lru_map(struct amdgpu_device *adev,
struct amdgpu_queue_mapper *mapper,
- int user_ring,
+ u32 user_ring,
struct amdgpu_ring **out_ring)
{
int r, i, j;
@@ -208,7 +208,7 @@ int amdgpu_queue_mgr_fini(struct amdgpu_device *adev,
*/
int amdgpu_queue_mgr_map(struct amdgpu_device *adev,
struct amdgpu_queue_mgr *mgr,
- int hw_ip, int instance, int ring,
+ u32 hw_ip, u32 instance, u32 ring,
struct amdgpu_ring **out_ring)
{
int r, ip_num_rings;
--
2.15.0