forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

drm/amdgpu: add chunk id validity check

Browse source 
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Christian König 2015-06-23 17:07:03 +02:00 • committed by Alex Deucher
parent b8682ac253
commit 9a5e8fb1c8
1 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
View file

@ -181,8 +181,6 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
} }
p->chunks[i].chunk_id = user_chunk.chunk_id; p->chunks[i].chunk_id = user_chunk.chunk_id;
p->chunks[i].length_dw = user_chunk.length_dw; p->chunks[i].length_dw = user_chunk.length_dw;
if (p->chunks[i].chunk_id == AMDGPU_CHUNK_ID_IB)
p->num_ibs++;
size = p->chunks[i].length_dw; size = p->chunks[i].length_dw;
cdata = (void __user *)(unsigned long)user_chunk.chunk_data; cdata = (void __user *)(unsigned long)user_chunk.chunk_data;
@ -199,7 +197,12 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
goto out; goto out;
} }
if (p->chunks[i].chunk_id == AMDGPU_CHUNK_ID_FENCE) { switch (p->chunks[i].chunk_id) {
case AMDGPU_CHUNK_ID_IB:
p->num_ibs++;
break;
case AMDGPU_CHUNK_ID_FENCE:
size = sizeof(struct drm_amdgpu_cs_chunk_fence); size = sizeof(struct drm_amdgpu_cs_chunk_fence);
if (p->chunks[i].length_dw * sizeof(uint32_t) >= size) { if (p->chunks[i].length_dw * sizeof(uint32_t) >= size) {
uint32_t handle; uint32_t handle;
@ -221,6 +224,11 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
r = -EINVAL; r = -EINVAL;
goto out; goto out;
} }
break;
default:
r = -EINVAL;
goto out;
} }
} }