diff options
| author | Jérôme Glisse <jglisse@redhat.com> | 2017-02-06 23:13:18 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2017-02-09 04:59:16 +0300 |
| commit | 3b4821f8a4597c01318f3bebe208789bcf80aac9 (patch) | |
| tree | c96598ceddd397682b27b96b9dc069b71c6b1c7f /drivers/gpu/drm/radeon/vce_v1_0.c | |
| parent | 5ada90d55f6f652ae1103dac38bb92b445a368c5 (diff) | |
| download | linux-3b4821f8a4597c01318f3bebe208789bcf80aac9.tar.xz | |
drm/radeon: avoid kernel segfault in vce when gpu fails to resume
When GPU fails to resume we can not trust that value we write to GPU
memory will post and we might get garbage (more like 0xffffffff on
x86) when reading them back. This trigger out of range memory access
in the kernel inside the vce resume code path.
This patch use canonical value to compute offset instead of reading
back value from GPU memory.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/radeon/vce_v1_0.c')
| -rw-r--r-- | drivers/gpu/drm/radeon/vce_v1_0.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/vce_v1_0.c b/drivers/gpu/drm/radeon/vce_v1_0.c index a01efe39a820..f541a4b5ac51 100644 --- a/drivers/gpu/drm/radeon/vce_v1_0.c +++ b/drivers/gpu/drm/radeon/vce_v1_0.c @@ -196,7 +196,7 @@ int vce_v1_0_load_fw(struct radeon_device *rdev, uint32_t *data) memset(&data[5], 0, 44); memcpy(&data[16], &sign[1], rdev->vce_fw->size - sizeof(*sign)); - data += le32_to_cpu(data[4]) / 4; + data += (le32_to_cpu(sign->len) + 64) / 4; data[0] = sign->val[i].sigval[0]; data[1] = sign->val[i].sigval[1]; data[2] = sign->val[i].sigval[2]; |