Re: [PATCH] drm/i915: Fix possible overflow when recording semaphore states.

[Damien Lespiau <damien.lespiau@intel.com>]

On Thu, Jul 17, 2014 at 02:31:14PM -0700, Ben Widawsky wrote:
> > -	for_each_ring(useless, dev_priv, i) {
> > +	for_each_ring(to, dev_priv, i) {
> >  		u16 signal_offset =
> >  			(GEN8_SIGNAL_OFFSET(ring, i) & PAGE_MASK) / 4;
> >  		u32 *tmp = error->semaphore_obj->pages[0];
> > +		int idx = intel_ring_sync_index(ring, to);
> >  
> > -		ering->semaphore_mboxes[i] = tmp[signal_offset];
> > -		ering->semaphore_seqno[i] = ring->semaphore.sync_seqno[i];
> > +		ering->semaphore_mboxes[idx] = tmp[signal_offset];
> > +		ering->semaphore_seqno[idx] = ring->semaphore.sync_seqno[idx];
> >  	}
> >  }
> >  
> This patch looks correct to me.

We're still looping over all the rings aren't we? we'll override the
array when ring == to?

-- 
Damien