iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/i915/gvt: Fix cmd length check for MI_ATOMIC

Browse Source 
commit 92b1aa773f upstream.

Correct valid command length check for MI_ATOMIC, need to check inline
data available field instead of operand data length for whole command.

Fixes: 00a33be406 ("drm/i915/gvt: Add valid length check for MI variable commands")
Reported-by: Alex Williamson <alex.williamson@redhat.com>
Acked-by: Gao Fred <fred.gao@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Zhenyu Wang
2019-11-21 13:57:45 +08:00
committed by Greg Kroah-Hartman
parent f458582452
commit f745d9713e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/gpu/drm/i915/gvt/cmd_parser.c
View File

@ -1597,9 +1597,9 @@ static int cmd_handler_mi_op_2f(struct parser_exec_state *s)
if (!(cmd_val(s, 0) & (1 << 22))) if (!(cmd_val(s, 0) & (1 << 22)))
return ret; return ret;
/* check if QWORD */ /* check inline data */
if (DWORD_FIELD(0, 20, 19) == 1) if (cmd_val(s, 0) & BIT(18))
valid_len += 8; valid_len = CMD_LEN(9);
ret = gvt_check_valid_cmd_length(cmd_length(s), ret = gvt_check_valid_cmd_length(cmd_length(s),
valid_len); valid_len);
if (ret) if (ret)