From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE321C2BA19 for ; Sat, 11 Apr 2020 23:29:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B899E206E9 for ; Sat, 11 Apr 2020 23:29:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586647776; bh=gxcoV2qpI5IWHpmQs+fyevwYN5HNxlyLXon5O6O47ZQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=P/Y5IjhuMLWNXV3ZVwC0lDyzIm19W6PNp/GLp3jlIuLM/Fat6rKzEkxa/PhMJJ6M+ wrKExh3c/4tg99AS3JjFHqGzmDCbytVUCmVos8TeHKwLcQb2yNVIpii0rTXlwUa2eI O7zz1ybR9HNric7GT8QyXxiL6C8jpuF3xTc5fFrg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730626AbgDKX3f (ORCPT ); Sat, 11 Apr 2020 19:29:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:50174 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729753AbgDKXLA (ORCPT ); Sat, 11 Apr 2020 19:11:00 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 038A32192A; Sat, 11 Apr 2020 23:10:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1586646661; bh=gxcoV2qpI5IWHpmQs+fyevwYN5HNxlyLXon5O6O47ZQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lKl3PKc0kchAvaYBJ1gjdx/i2Apl9VTFPV8pgEOtk5VrdzmGr0gGWf8mU0eaMqFUQ MkhnWPc3x6giA8Sp/btfkxq0zxvkVn/KeN+nQmcWeDx/0wOljFtywrWixF/qinWX4l e+gFoGSu2efIKX8UtBK0tZhwCW0RO0/gPB/E3lHg= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Peikang Zhang , Aric Cyr , Rodrigo Siqueira , Harry Wentland , Alex Deucher , Sasha Levin , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org Subject: [PATCH AUTOSEL 5.4 062/108] drm/amd/display: System crashes when add_ptb_to_table() gets called Date: Sat, 11 Apr 2020 19:08:57 -0400 Message-Id: <20200411230943.24951-62-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200411230943.24951-1-sashal@kernel.org> References: <20200411230943.24951-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Peikang Zhang [ Upstream commit 0062972b9d9f888d0273c6496769d02e8f509135 ] [Why] Unused VMIDs were not evicted correctly [How] 1. evict_vmids() logic was fixed; 2. Added boundary check for add_ptb_to_table() and clear_entry_from_vmid_table() to avoid crash caused by array out of boundary; 3. For mod_vmid_get_for_ptb(), vimd is changed from unsigned to signed due to vimd is signed. Signed-off-by: Peikang Zhang Reviewed-by: Aric Cyr Acked-by: Rodrigo Siqueira Acked-by: Harry Wentland Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin --- drivers/gpu/drm/amd/display/modules/vmid/vmid.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/display/modules/vmid/vmid.c b/drivers/gpu/drm/amd/display/modules/vmid/vmid.c index f0a153704f6e0..00f132f8ad55d 100644 --- a/drivers/gpu/drm/amd/display/modules/vmid/vmid.c +++ b/drivers/gpu/drm/amd/display/modules/vmid/vmid.c @@ -40,14 +40,18 @@ struct core_vmid { static void add_ptb_to_table(struct core_vmid *core_vmid, unsigned int vmid, uint64_t ptb) { - core_vmid->ptb_assigned_to_vmid[vmid] = ptb; - core_vmid->num_vmids_available--; + if (vmid < MAX_VMID) { + core_vmid->ptb_assigned_to_vmid[vmid] = ptb; + core_vmid->num_vmids_available--; + } } static void clear_entry_from_vmid_table(struct core_vmid *core_vmid, unsigned int vmid) { - core_vmid->ptb_assigned_to_vmid[vmid] = 0; - core_vmid->num_vmids_available++; + if (vmid < MAX_VMID) { + core_vmid->ptb_assigned_to_vmid[vmid] = 0; + core_vmid->num_vmids_available++; + } } static void evict_vmids(struct core_vmid *core_vmid) @@ -57,7 +61,7 @@ static void evict_vmids(struct core_vmid *core_vmid) // At this point any positions with value 0 are unused vmids, evict them for (i = 1; i < core_vmid->num_vmid; i++) { - if (ord & (1u << i)) + if (!(ord & (1u << i))) clear_entry_from_vmid_table(core_vmid, i); } } @@ -91,7 +95,7 @@ static int get_next_available_vmid(struct core_vmid *core_vmid) uint8_t mod_vmid_get_for_ptb(struct mod_vmid *mod_vmid, uint64_t ptb) { struct core_vmid *core_vmid = MOD_VMID_TO_CORE(mod_vmid); - unsigned int vmid = 0; + int vmid = 0; // Physical address gets vmid 0 if (ptb == 0) -- 2.20.1