Re: [PATCH 04/22] drm/tegra: Check for malformed offsets and sizes in the 'submit' IOCTL

2017-06-01 Thread Mikko Perttunen
Just some comments on comments (?!). With those fixed, Reviewed-by: Mikko Perttunen On 05/23/2017 03:14 AM, Dmitry Osipenko wrote: If commands buffer claims a number of words that is higher than its BO can fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was triggered by a

[PATCH 04/22] drm/tegra: Check for malformed offsets and sizes in the 'submit' IOCTL

2017-05-22 Thread Dmitry Osipenko
If commands buffer claims a number of words that is higher than its BO can fit, a kernel OOPS will be fired on the out-of-bounds BO access. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. The CMDA commands buffer address is 4 bytes aligned,