diff options
| author | Aleksei Gimbitskii <aleksei.gimbitskii@intel.com> | 2019-05-02 11:59:21 +0200 |
|---|---|---|
| committer | Zhenyu Wang <zhenyuw@linux.intel.com> | 2019-05-30 11:21:19 +0200 |
| commit | 27348cc9c8ec5588cd5fd66250cf846e35c25055 (patch) | |
| tree | 582867a8a330983abe2442f8adea96cf3dd8a4ff | |
| parent | drm/i915/gvt: Fix cmd length of VEB_DI_IECP (diff) | |
| download | linux-27348cc9c8ec5588cd5fd66250cf846e35c25055.tar.xz linux-27348cc9c8ec5588cd5fd66250cf846e35c25055.zip | |
drm/i915/gvt: Check if cur_pt_type is valid
Static code analyzer warns that index value for scratch_pt may be equal
to -1. Index value type is intel_gvt_gtt_type_t, so it may be any number
at range -1 to 17. Check first if cur_pt_type and cur_pt_type+1 is valid
values.
v2:
- Print some error messages if page table type is invalid. (Colin Xu)
v4:
- Print cur_pt_type in error message. (Colin Xu)
This patch fixed the critial issue #422 reported by klocwork.
Acked-by: Colin Xu <colin.xu@intel.com>
Signed-off-by: Aleksei Gimbitskii <aleksei.gimbitskii@intel.com>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: Zhi Wang <zhi.a.wang@intel.com>
Cc: Colin Xu <colin.xu@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/gtt.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index d767c45a57e2..3f83df533525 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -948,7 +948,16 @@ static int ppgtt_invalidate_spt_by_shadow_entry(struct intel_vgpu *vgpu, if (e->type != GTT_TYPE_PPGTT_ROOT_L3_ENTRY && e->type != GTT_TYPE_PPGTT_ROOT_L4_ENTRY) { - cur_pt_type = get_next_pt_type(e->type) + 1; + cur_pt_type = get_next_pt_type(e->type); + + if (!gtt_type_is_pt(cur_pt_type) || + !gtt_type_is_pt(cur_pt_type + 1)) { + WARN(1, "Invalid page table type, cur_pt_type is: %d\n", cur_pt_type); + return -EINVAL; + } + + cur_pt_type += 1; + if (ops->get_pfn(e) == vgpu->gtt.scratch_pt[cur_pt_type].page_mfn) return 0; |