| Message ID | 20170206201318.8520-1-j.glisse@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Am 06.02.2017 um 21:13 schrieb j.glisse@gmail.com: > From: Jérôme Glisse <jglisse@redhat.com> > > When GPU fails to resume we can not trust that value we write to GPU > memory will post and we might get garbage (more like 0xffffffff on > x86) when reading them back. This trigger out of range memory access > in the kernel inside the vce resume code path. > > This patch use canonical value to compute offset instead of reading > back value from GPU memory. > > Signed-off-by: Jérôme Glisse <jglisse@redhat.com> Good point, path is Reviewed-by: Christian König <christian.koenig@amd.com>. Regards, Christian. > --- > drivers/gpu/drm/radeon/vce_v1_0.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c b/drivers/gpu/drm/radeon/vce_v1_0.c > index a01efe3..f541a4b 100644 > --- a/drivers/gpu/drm/radeon/vce_v1_0.c > +++ b/drivers/gpu/drm/radeon/vce_v1_0.c > @@ -196,7 +196,7 @@ int vce_v1_0_load_fw(struct radeon_device *rdev, uint32_t *data) > memset(&data[5], 0, 44); > memcpy(&data[16], &sign[1], rdev->vce_fw->size - sizeof(*sign)); > > - data += le32_to_cpu(data[4]) / 4; > + data += (le32_to_cpu(sign->len) + 64) / 4; > data[0] = sign->val[i].sigval[0]; > data[1] = sign->val[i].sigval[1]; > data[2] = sign->val[i].sigval[2];
On Tue, Feb 7, 2017 at 5:51 AM, Christian König <deathsimple@vodafone.de> wrote: > Am 06.02.2017 um 21:13 schrieb j.glisse@gmail.com: >> >> From: Jérôme Glisse <jglisse@redhat.com> >> >> When GPU fails to resume we can not trust that value we write to GPU >> memory will post and we might get garbage (more like 0xffffffff on >> x86) when reading them back. This trigger out of range memory access >> in the kernel inside the vce resume code path. >> >> This patch use canonical value to compute offset instead of reading >> back value from GPU memory. >> >> Signed-off-by: Jérôme Glisse <jglisse@redhat.com> Applied. Thanks! Alex > > > Good point, path is Reviewed-by: Christian König <christian.koenig@amd.com>. > > Regards, > Christian. > >> --- >> drivers/gpu/drm/radeon/vce_v1_0.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c >> b/drivers/gpu/drm/radeon/vce_v1_0.c >> index a01efe3..f541a4b 100644 >> --- a/drivers/gpu/drm/radeon/vce_v1_0.c >> +++ b/drivers/gpu/drm/radeon/vce_v1_0.c >> @@ -196,7 +196,7 @@ int vce_v1_0_load_fw(struct radeon_device *rdev, >> uint32_t *data) >> memset(&data[5], 0, 44); >> memcpy(&data[16], &sign[1], rdev->vce_fw->size - sizeof(*sign)); >> - data += le32_to_cpu(data[4]) / 4; >> + data += (le32_to_cpu(sign->len) + 64) / 4; >> data[0] = sign->val[i].sigval[0]; >> data[1] = sign->val[i].sigval[1]; >> data[2] = sign->val[i].sigval[2]; > > > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel
diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c b/drivers/gpu/drm/radeon/vce_v1_0.c index a01efe3..f541a4b 100644 --- a/drivers/gpu/drm/radeon/vce_v1_0.c +++ b/drivers/gpu/drm/radeon/vce_v1_0.c @@ -196,7 +196,7 @@ int vce_v1_0_load_fw(struct radeon_device *rdev, uint32_t *data) memset(&data[5], 0, 44); memcpy(&data[16], &sign[1], rdev->vce_fw->size - sizeof(*sign)); - data += le32_to_cpu(data[4]) / 4; + data += (le32_to_cpu(sign->len) + 64) / 4; data[0] = sign->val[i].sigval[0]; data[1] = sign->val[i].sigval[1]; data[2] = sign->val[i].sigval[2];