leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/i915: Use unsigned for overflow checks in execbuf

Browse Source 
There's actually no real risk since we already check for stricter
constraints earlier (using UINT_MAX / sizeof (struct
drm_i915_gem_exec_object2) as the limit). But in eb_create we use
signed integers, which steals a factor of 2. Luckily struct
drm_i915_gem_exec_object2 for this to not matter.

Still, be consistent and use unsigned integers.

Similar use unsinged integers when checking for overflows in the
relocation entry processing.

I've also added a new subtests to igt/gem_reloc_overflow to also
test for overflowing args->buffer_count values.

v2: Give the variables again tighter scope to make it clear that the
computation is purely local and doesn't leak out to the 2nd block.
Requested by Chris Wilson.

Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
This commit is contained in:
Daniel Vetter 2013-09-19 14:00:11 +02:00
parent 955382f389
commit b205ca5721
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/gpu/drm/i915/i915_gem_execbuffer.c
View File

@ -48,15 +48,15 @@ eb_create(struct drm_i915_gem_execbuffer2 *args, struct i915_address_space *vm)
struct eb_vmas *eb = NULL; struct eb_vmas *eb = NULL;
if (args->flags & I915_EXEC_HANDLE_LUT) { if (args->flags & I915_EXEC_HANDLE_LUT) {
int size = args->buffer_count; unsigned size = args->buffer_count;
size *= sizeof(struct i915_vma *); size *= sizeof(struct i915_vma *);
size += sizeof(struct eb_vmas); size += sizeof(struct eb_vmas);
eb = kmalloc(size, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY); eb = kmalloc(size, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
} }
if (eb == NULL) { if (eb == NULL) {
int size = args->buffer_count; unsigned size = args->buffer_count;
int count = PAGE_SIZE / sizeof(struct hlist_head) / 2; unsigned count = PAGE_SIZE / sizeof(struct hlist_head) / 2;
BUILD_BUG_ON_NOT_POWER_OF_2(PAGE_SIZE / sizeof(struct hlist_head)); BUILD_BUG_ON_NOT_POWER_OF_2(PAGE_SIZE / sizeof(struct hlist_head));
while (count > 2*size) while (count > 2*size)
count >>= 1; count >>= 1;
@ -667,7 +667,7 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
bool need_relocs; bool need_relocs;
int *reloc_offset; int *reloc_offset;
int i, total, ret; int i, total, ret;
int count = args->buffer_count; unsigned count = args->buffer_count;
if (WARN_ON(list_empty(&eb->vmas))) if (WARN_ON(list_empty(&eb->vmas)))
return 0; return 0;
@ -818,8 +818,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
int count) int count)
{ {
int i; int i;
int relocs_total = 0; unsigned relocs_total = 0;
int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry); unsigned relocs_max = UINT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
char __user *ptr = to_user_ptr(exec[i].relocs_ptr); char __user *ptr = to_user_ptr(exec[i].relocs_ptr);