Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1417fad7 authored by Xinyun Liu's avatar Xinyun Liu Committed by Zhenyu Wang
Browse files

drm/i915/gvt: use array to avoid potential buffer overflow 



Array 'pdp_pair' of size 1 may use index value(s) 1..7.
Changed to pdps[8] to avoid confusion.

Signed-off-by: default avatarXinyun Liu <xinyun.liu@intel.com>
Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
parent 65957195

drivers/gpu/drm/i915/gvt/execlist.h

+5 −8
Original line number Diff line number Diff line
@@ -146,14 +146,11 @@ struct execlist_ring_context { 
	u32 nop4;

	u32 lri_cmd_2;

	struct execlist_mmio_pair ctx_timestamp;

	struct execlist_mmio_pair pdp3_UDW;

	struct execlist_mmio_pair pdp3_LDW;

	struct execlist_mmio_pair pdp2_UDW;

	struct execlist_mmio_pair pdp2_LDW;

	struct execlist_mmio_pair pdp1_UDW;

	struct execlist_mmio_pair pdp1_LDW;

	struct execlist_mmio_pair pdp0_UDW;

	struct execlist_mmio_pair pdp0_LDW;

	/*

	 * pdps[8]={ pdp3_UDW, pdp3_LDW, pdp2_UDW, pdp2_LDW,

	 *           pdp1_UDW, pdp1_LDW, pdp0_UDW, pdp0_LDW}

	 */

	struct execlist_mmio_pair pdps[8];

};



struct intel_vgpu_elsp_dwords {

drivers/gpu/drm/i915/gvt/scheduler.c

+2 −3
Original line number Diff line number Diff line
@@ -45,11 +45,10 @@ static void set_context_pdp_root_pointer( 
		struct execlist_ring_context *ring_context,

		u32 pdp[8])

{

	struct execlist_mmio_pair *pdp_pair = &ring_context->pdp3_UDW;

	int i;



	for (i = 0; i < 8; i++)

		pdp_pair[i].val = pdp[7 - i];

		ring_context->pdps[i].val = pdp[7 - i];

}



static void update_shadow_pdps(struct intel_vgpu_workload *workload)
@@ -1230,7 +1229,7 @@ static void read_guest_pdps(struct intel_vgpu *vgpu, 
	u64 gpa;

	int i;



	gpa = ring_context_gpa + RING_CTX_OFF(pdp3_UDW.val);

	gpa = ring_context_gpa + RING_CTX_OFF(pdps[0].val);



	for (i = 0; i < 8; i++)

		intel_gvt_hypervisor_read_gpa(vgpu,