drm/i915/gvt: Audit the command buffer address
authorPing Gao <ping.a.gao@intel.com>
Tue, 4 Jul 2017 08:09:58 +0000 (16:09 +0800)
committerZhenyu Wang <zhenyuw@linux.intel.com>
Tue, 11 Jul 2017 05:46:58 +0000 (13:46 +0800)
The command buffer address in context like ring buffer base address
and wa_ctx address need to be audit to make sure they are in the
valid GGTT range.

Signed-off-by: Ping Gao <ping.a.gao@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
drivers/gpu/drm/i915/gvt/cmd_parser.c

index 51241de5e7a74ce68f7fdf732165c5ec1373f491..713848c3634946bea6c9805a3a705c22c1b8c08c 100644 (file)
@@ -2536,6 +2536,11 @@ static int scan_workload(struct intel_vgpu_workload *workload)
                gma_head == gma_tail)
                return 0;
 
+       if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) {
+               ret = -EINVAL;
+               goto out;
+       }
+
        ret = ip_gma_set(&s, gma_head);
        if (ret)
                goto out;
@@ -2579,6 +2584,11 @@ static int scan_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
        s.rb_va = wa_ctx->indirect_ctx.shadow_va;
        s.workload = workload;
 
+       if (!intel_gvt_ggtt_validate_range(s.vgpu, s.ring_start, s.ring_size)) {
+               ret = -EINVAL;
+               goto out;
+       }
+
        ret = ip_gma_set(&s, gma_head);
        if (ret)
                goto out;