Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 60ccb31b authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-intel-fixes-2017-11-08' of... 

Merge tag 'drm-intel-fixes-2017-11-08' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes

- Fix possible NULL dereference (Chris).
- Avoid miss usage of syncobj by rejecting unknown flags (Tvrtko).

* tag 'drm-intel-fixes-2017-11-08' of git://anongit.freedesktop.org/drm/drm-intel:
  drm/i915: Deconstruct struct sgt_dma initialiser
  drm/i915: Reject unknown syncobj flags
parents 17208f1d 423a8a94

drivers/gpu/drm/i915/i915_gem_execbuffer.c

+8 −0
Original line number Original line Diff line number Diff line
@@ -2094,6 +2094,11 @@ get_fence_array(struct drm_i915_gem_execbuffer2 *args, 
			goto err;

			goto err;

		}

		}





		if (fence.flags & __I915_EXEC_FENCE_UNKNOWN_FLAGS) {

			err = -EINVAL;

			goto err;

		}



		syncobj = drm_syncobj_find(file, fence.handle);

		syncobj = drm_syncobj_find(file, fence.handle);

		if (!syncobj) {

		if (!syncobj) {

			DRM_DEBUG("Invalid syncobj handle provided\n");

			DRM_DEBUG("Invalid syncobj handle provided\n");
@@ -2101,6 +2106,9 @@ get_fence_array(struct drm_i915_gem_execbuffer2 *args, 
			goto err;

			goto err;

		}

		}





		BUILD_BUG_ON(~(ARCH_KMALLOC_MINALIGN - 1) &

			     ~__I915_EXEC_FENCE_UNKNOWN_FLAGS);



		fences[n] = ptr_pack_bits(syncobj, fence.flags, 2);

		fences[n] = ptr_pack_bits(syncobj, fence.flags, 2);

	}

	}

drivers/gpu/drm/i915/i915_gem_gtt.c

+9 −16
Original line number Original line Diff line number Diff line
@@ -832,10 +832,14 @@ static void gen8_ppgtt_clear_4lvl(struct i915_address_space *vm, 
	}

	}

}

}





struct sgt_dma {

static inline struct sgt_dma {

	struct scatterlist *sg;

	struct scatterlist *sg;

	dma_addr_t dma, max;

	dma_addr_t dma, max;

};

} sgt_dma(struct i915_vma *vma) {

	struct scatterlist *sg = vma->pages->sgl;

	dma_addr_t addr = sg_dma_address(sg);

	return (struct sgt_dma) { sg, addr, addr + sg->length };

}





struct gen8_insert_pte {

struct gen8_insert_pte {

	u16 pml4e;

	u16 pml4e;
@@ -916,11 +920,7 @@ static void gen8_ppgtt_insert_3lvl(struct i915_address_space *vm, 
				   u32 unused)

				   u32 unused)

{

{

	struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm);

	struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm);

	struct sgt_dma iter = {

	struct sgt_dma iter = sgt_dma(vma);

		.sg = vma->pages->sgl,

		.dma = sg_dma_address(iter.sg),

		.max = iter.dma + iter.sg->length,

	};

	struct gen8_insert_pte idx = gen8_insert_pte(vma->node.start);

	struct gen8_insert_pte idx = gen8_insert_pte(vma->node.start);





	gen8_ppgtt_insert_pte_entries(ppgtt, &ppgtt->pdp, &iter, &idx,

	gen8_ppgtt_insert_pte_entries(ppgtt, &ppgtt->pdp, &iter, &idx,
@@ -933,11 +933,7 @@ static void gen8_ppgtt_insert_4lvl(struct i915_address_space *vm, 
				   u32 unused)

				   u32 unused)

{

{

	struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm);

	struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm);

	struct sgt_dma iter = {

	struct sgt_dma iter = sgt_dma(vma);

		.sg = vma->pages->sgl,

		.dma = sg_dma_address(iter.sg),

		.max = iter.dma + iter.sg->length,

	};

	struct i915_page_directory_pointer **pdps = ppgtt->pml4.pdps;

	struct i915_page_directory_pointer **pdps = ppgtt->pml4.pdps;

	struct gen8_insert_pte idx = gen8_insert_pte(vma->node.start);

	struct gen8_insert_pte idx = gen8_insert_pte(vma->node.start);
@@ -1632,13 +1628,10 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm, 
	unsigned act_pt = first_entry / GEN6_PTES;

	unsigned act_pt = first_entry / GEN6_PTES;

	unsigned act_pte = first_entry % GEN6_PTES;

	unsigned act_pte = first_entry % GEN6_PTES;

	const u32 pte_encode = vm->pte_encode(0, cache_level, flags);

	const u32 pte_encode = vm->pte_encode(0, cache_level, flags);

	struct sgt_dma iter;

	struct sgt_dma iter = sgt_dma(vma);

	gen6_pte_t *vaddr;

	gen6_pte_t *vaddr;





	vaddr = kmap_atomic_px(ppgtt->pd.page_table[act_pt]);

	vaddr = kmap_atomic_px(ppgtt->pd.page_table[act_pt]);

	iter.sg = vma->pages->sgl;

	iter.dma = sg_dma_address(iter.sg);

	iter.max = iter.dma + iter.sg->length;

	do {

	do {

		vaddr[act_pte] = pte_encode | GEN6_PTE_ADDR_ENCODE(iter.dma);

		vaddr[act_pte] = pte_encode | GEN6_PTE_ADDR_ENCODE(iter.dma);

include/uapi/drm/i915_drm.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -829,6 +829,7 @@ struct drm_i915_gem_exec_fence { 




#define I915_EXEC_FENCE_WAIT            (1<<0)

#define I915_EXEC_FENCE_WAIT            (1<<0)

#define I915_EXEC_FENCE_SIGNAL          (1<<1)

#define I915_EXEC_FENCE_SIGNAL          (1<<1)

#define __I915_EXEC_FENCE_UNKNOWN_FLAGS (-(I915_EXEC_FENCE_SIGNAL << 1))

	__u32 flags;

	__u32 flags;

};

};