[PATCH 3/3] drm/tegra: Check size of a submitted command buffer

2017-05-12 Thread Dmitry Osipenko
If command buffer claims a number of words that is higher than its BO can fit and a relocation lays past the BO, a kernel OOPS will be fired on that relocation address patching. This was triggered by an opentegra Xorg driver that erroneously pushed too many commands to the pushbuf. [ 46.829393]

Re: [PATCH 3/3] drm/tegra: Check size of a submitted command buffer

2017-05-12 Thread Dmitry Osipenko
On 12.05.2017 22:06, Erik Faye-Lund wrote: > On Fri, May 12, 2017 at 9:02 PM, Dmitry Osipenko wrote: >> + if (cmdbuf.words * 4 > gem->size) { > > Shouldn't this be "cmdbuf.offset + cmdbuf.words * 4 > gem->size"? > Seems yes, good catch. Thank you :) -- Dmitry ___

Re: [PATCH 3/3] drm/tegra: Check size of a submitted command buffer

2017-05-12 Thread Erik Faye-Lund
On Fri, May 12, 2017 at 9:02 PM, Dmitry Osipenko wrote: > If command buffer claims a number of words that is higher than its BO can > fit and a relocation lays past the BO, a kernel OOPS will be fired on that > relocation address patching. This was triggered by an opentegra Xorg driver > that erro