Intel-GFX Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Intel-gfx] [PATCH] drm/i915/execbuf: don't allow zero batch_len
@ 2020-10-13 11:18 Matthew Auld
  2020-10-13 11:58 ` Chris Wilson
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: Matthew Auld @ 2020-10-13 11:18 UTC (permalink / raw)
  To: intel-gfx; +Cc: Chris Wilson

As per the ABI batch_len is u32, however if the batch_len is left unset,
then the kernel will just assume batch_len is the size of the whole
batch object, however since the vma->size is u64, while the batch_len is
just u32 we can end up with batch_len = 0 if we are given too large batch
object(e.g 1ULL << 32), which doesn't look the intended behaviour and
probably leads to explosions on some HW.

Testcase: igt/gem_exec_params/larger-than-life-batch
Fixes: 0b5372727be3 ("drm/i915/cmdparser: Use cached vmappings")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 4b09bcd70cf4..80c738c72e6e 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -869,8 +869,13 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
 		return -EINVAL;
 	}
 
-	if (eb->batch_len == 0)
+	if (eb->batch_len == 0) {
 		eb->batch_len = eb->batch->vma->size - eb->batch_start_offset;
+		if (unlikely(eb->batch_len == 0)) {
+			drm_dbg(&i915->drm, "Attempting to use too large batch\n");
+			return -EINVAL;
+		}
+	}
 
 	return 0;
 
-- 
2.26.2

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2020-10-14  7:18 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-10-13 11:18 [Intel-gfx] [PATCH] drm/i915/execbuf: don't allow zero batch_len Matthew Auld
2020-10-13 11:58 ` Chris Wilson
2020-10-13 12:07   ` Chris Wilson
2020-10-13 14:07   ` Matthew Auld
2020-10-13 14:11     ` Chris Wilson
2020-10-13 13:58 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
2020-10-14  7:18 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox