Re: [PATCH] drm/tegra: Check offsets of a submitted command buffer and of relocations

[Dmitry Osipenko <digetx-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>]

On 16.05.2017 09:56, Mikko Perttunen wrote:
> On 14.05.2017 23:47, Dmitry Osipenko wrote:
>> +        if (reloc->cmdbuf.offset & 3 ||
>> +            reloc->cmdbuf.offset > obj->gem.size) {
> 
> This could still fail if the bo's size is not divisible by 4, even with >=
> comparison (we would overwrite the buffer by 1 to 3 bytes). I would do the same
> as in the gather case, i.e. find out the address immediately after the write and
> compare using >. Perhaps add a helper function if it makes sense. I also don't
> think the "& 3" checks are needed.
> 
Sorry, I forgot to mention the reason of the relocations cmdbuf offset alignment
requirement in the commit description. So the reason is that during the patching
of the gather in do_relocs(), the unaligned offset would cause a partial
overwrite of the command buffer word following the relocation and only a part of
the relocation address being written to the actual address word.