[PATCH] drm/i915: Use a temporary va_list for two-pass string handling

[PATCH] drm/i915: Use a temporary va_list for two-pass string handling

[Chris Wilson]

In

commit edc3d8848dc9fe2a470316363dab8ef211d77e01
Author: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Date:   Thu May 23 13:55:35 2013 +0300

    drm/i915: avoid big kmallocs on reading error state

we introduce a two-pass mechanism for splitting long strings being
formatted into the error-state. The first pass finds the length, and the
second pass emits the right portion of the string into the accumulation
buffer. Unfortunately we use the same va_list for both passes, resulting
in the second pass reading garbage off the end of the argument list. As
the two passes are only used for boundaries between read() calls, the
corruption is only rarely seen.

This fixes the root cause behind

commit baf27f9b17bf2f369f3865e38c41d2163e8d815d
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Sat Jun 29 23:26:50 2013 +0100

    drm/i915: Break up the large vsnprintf() in print_error_buffers()

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: stable@vger.kernel.org
---
 drivers/gpu/drm/i915/i915_gpu_error.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index c38d575..7bea613 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -143,8 +143,10 @@ static void i915_error_vprintf(struct drm_i915_error_state_buf *e,
 
 	/* Seek the first printf which is hits start position */
 	if (e->pos < e->start) {
-		len = vsnprintf(NULL, 0, f, args);
-		if (!__i915_error_seek(e, len))
+		va_list tmp;
+
+		va_copy(tmp, args);
+		if (!__i915_error_seek(e, vsnprintf(NULL, 0, f, tmp)))
 			return;
 	}
 
-- 
1.8.4.rc3

Re: [PATCH] drm/i915: Use a temporary va_list for two-pass string handling

[Daniel Vetter]

On Fri, Sep 20, 2013 at 10:20:59AM +0100, Chris Wilson wrote:
> In
> 
> commit edc3d8848dc9fe2a470316363dab8ef211d77e01
> Author: Mika Kuoppala <mika.kuoppala@linux.intel.com>
> Date:   Thu May 23 13:55:35 2013 +0300
> 
>     drm/i915: avoid big kmallocs on reading error state
> 
> we introduce a two-pass mechanism for splitting long strings being
> formatted into the error-state. The first pass finds the length, and the
> second pass emits the right portion of the string into the accumulation
> buffer. Unfortunately we use the same va_list for both passes, resulting
> in the second pass reading garbage off the end of the argument list. As
> the two passes are only used for boundaries between read() calls, the
> corruption is only rarely seen.
> 
> This fixes the root cause behind
> 
> commit baf27f9b17bf2f369f3865e38c41d2163e8d815d
> Author: Chris Wilson <chris@chris-wilson.co.uk>
> Date:   Sat Jun 29 23:26:50 2013 +0100
> 
>     drm/i915: Break up the large vsnprintf() in print_error_buffers()
> 
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Mika Kuoppala <mika.kuoppala@intel.com>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: stable@vger.kernel.org

Picked up for -fixes, thanks for the patch.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch