drm/i915/gvt: Set up-limit of BB size to 2GB.

Submitted by Colin Xu on June 3, 2019, 6:47 a.m.

Details

Message ID 20190603064744.7298-1-colin.xu@intel.com
State New
Headers show
Series "drm/i915/gvt: Set up-limit of BB size to 2GB." ( rev: 1 ) in Intel GVT devel

Not browsing as part of any series.

Commit Message

Colin Xu June 3, 2019, 6:47 a.m.
Set default maximum batch buffer size to 2GB to prevent overflow.

Signed-off-by: Colin Xu <colin.xu@intel.com>
---
 drivers/gpu/drm/i915/gvt/cmd_parser.c | 6 ++++++
 drivers/gpu/drm/i915/gvt/gvt.h        | 2 ++
 2 files changed, 8 insertions(+)

Patch hide | download patch | download mbox

diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 7c7b711942cd..02cedb34b859 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -1710,6 +1710,12 @@  static int find_bb_size(struct parser_exec_state *s, unsigned long *bb_size)
 		}
 		cmd_len = get_cmd_length(info, cmd) << 2;
 		*bb_size += cmd_len;
+		if (*bb_size > INTEL_GVT_MAX_BB_LENGTH_DEFAULT) {
+			gvt_vgpu_err("BB len exceeds max limit 0x%llx\n",
+				     INTEL_GVT_MAX_BB_LENGTH_DEFAULT);
+			*bb_size = 0;
+			return -EOVERFLOW;
+		}
 		gma += cmd_len;
 	} while (!bb_end);
 
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index b54f2bdc13a4..a5e3ec97993b 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -231,6 +231,8 @@  struct intel_vgpu {
 	u32 scan_nonprivbb;
 };
 
+#define INTEL_GVT_MAX_BB_LENGTH_DEFAULT	0x80000000
+
 /* validating GM healthy status*/
 #define vgpu_is_vm_unhealthy(ret_val) \
 	(((ret_val) == -EBADRQC) || ((ret_val) == -EFAULT))

Comments