Re: [PATCH v2 2/2] drm/i915/cmdparser: Do not check past the cmd length.

2018-02-05 Thread Chris Wilson
Quoting Chris Wilson (2018-02-05 16:04:25) > Quoting Michal Srb (2018-02-05 15:17:45) > > The command MEDIA_VFE_STATE checks bits at offset +2 dwords. However, it is > > possible to have MEDIA_VFE_STATE command with length = 0 + LENGTH_BIAS = 2. > > In that case check_cmd will read bits from the fo

Re: [PATCH v2 2/2] drm/i915/cmdparser: Do not check past the cmd length.

2018-02-05 Thread Chris Wilson
Quoting Michal Srb (2018-02-05 15:17:45) > The command MEDIA_VFE_STATE checks bits at offset +2 dwords. However, it is > possible to have MEDIA_VFE_STATE command with length = 0 + LENGTH_BIAS = 2. > In that case check_cmd will read bits from the following command, or even past > the end of the buff

[PATCH v2 2/2] drm/i915/cmdparser: Do not check past the cmd length.

2018-02-05 Thread Michal Srb
The command MEDIA_VFE_STATE checks bits at offset +2 dwords. However, it is possible to have MEDIA_VFE_STATE command with length = 0 + LENGTH_BIAS = 2. In that case check_cmd will read bits from the following command, or even past the end of the buffer. If the offset ends up outside of the command