Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Pull up following revision(s) (requested by msaitoh in ticket #678): 

sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c: revision 1.12
	sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c: revision 1.2
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.9
	sys/external/bsd/drm2/dist/drm/i915/i915_reg.h: revision 1.12

 Use unsigned to avoid undefined behavior in gen7_get_stolen_reserved().
Found by kUBSan.

 Use unsigned to avoid undefined behavior in g4x_update_wm().

 Avoid undefined behavior in g4x_get_stolen_reserved().

The change is the same as newer i915_gem_stolen.c.

 Don't call memcpy() when the length is 0 (and the source pointer is NULL)
in radeon_dp_aux_transfer_atom() to avoid undefined behavior. Found by kUBSan.
This commit is contained in:
martin 2020-01-31 11:28:38 +00:00
parent dda8996267
commit 01a93c9ca9
3 changed files with 14 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sys/external/bsd/drm2/dist/drm/i915/i915_gem_stolen.c vendored
View File

@ -1,4 +1,4 @@
/* $NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $ */
/* $NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $ */
/*
* Copyright © 2008-2012 Intel Corporation
@ -29,7 +29,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11 2018/09/13 08:25:55 mrg Exp $");
__KERNEL_RCSID(0, "$NetBSD: i915_gem_stolen.c,v 1.11.4.1 2020/01/31 11:28:38 martin Exp $");
#include <linux/printk.h>
#include <linux/err.h>
@ -308,18 +308,13 @@ static void g4x_get_stolen_reserved(struct drm_i915_private *dev_priv,
unsigned long stolen_top = dev_priv->mm.stolen_base +
dev_priv->gtt.stolen_size;
*base = (reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK) << 16;
if (!(reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK))
return;
*base = (reg_val & G4X_STOLEN_RESERVED_ADDR2_MASK) << 16;
WARN_ON((reg_val & G4X_STOLEN_RESERVED_ADDR1_MASK) < *base);
/* On these platforms, the register doesn't have a size field, so the
* size is the distance between the base and the top of the stolen
* memory. We also have the genuine case where base is zero and there's
* nothing reserved. */
if (*base == 0)
*size = 0;
else
*size = stolen_top - *base;
*size = stolen_top - *base;
}
static void gen6_get_stolen_reserved(struct drm_i915_private *dev_priv,

6
sys/external/bsd/drm2/dist/drm/i915/i915_reg.h vendored
View File

@ -1,4 +1,4 @@
/* $NetBSD: i915_reg.h,v 1.7.2.2 2020/01/31 11:25:09 martin Exp $ */
/* $NetBSD: i915_reg.h,v 1.7.2.3 2020/01/31 11:28:38 martin Exp $ */
/* Copyright 2003 Tungsten Graphics, Inc., Cedar Park, Texas.
* All Rights Reserved.
@ -187,7 +187,7 @@
#define GEN6_STOLEN_RESERVED 0x1082C0
#define GEN6_STOLEN_RESERVED_ADDR_MASK (0xFFFUL << 20)
#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFF << 18)
#define GEN7_STOLEN_RESERVED_ADDR_MASK (0x3FFFUL << 18)
#define GEN6_STOLEN_RESERVED_SIZE_MASK (3 << 4)
#define GEN6_STOLEN_RESERVED_1M (0 << 4)
#define GEN6_STOLEN_RESERVED_512K (1 << 4)
@ -4616,7 +4616,7 @@ enum skl_disp_power_wells {
#define DSPFW_SPRITEA_MASK (0x7f<<0) /* g4x */
#define DSPFW_SPRITEA_MASK_VLV (0xff<<0) /* vlv/chv */
#define DSPFW3 (dev_priv->info.display_mmio_offset + 0x7003c)
#define DSPFW_HPLL_SR_EN (1<<31)
#define DSPFW_HPLL_SR_EN (1U<<31)
#define PINEVIEW_SELF_REFRESH_EN (1<<30)
#define DSPFW_CURSOR_SR_SHIFT 24
#define DSPFW_CURSOR_SR_MASK (0x3f<<24)

9
sys/external/bsd/drm2/dist/drm/radeon/radeon_atombios_dp.c vendored
View File

@ -1,4 +1,4 @@
/* $NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $ */
/* $NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $ */
/*
* Copyright 2007-8 Advanced Micro Devices, Inc.
@ -27,7 +27,7 @@
* Jerome Glisse
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1 2018/08/27 14:38:20 riastradh Exp $");
__KERNEL_RCSID(0, "$NetBSD: radeon_atombios_dp.c,v 1.1.8.1 2020/01/31 11:28:38 martin Exp $");
#include <drm/drmP.h>
#include <drm/radeon_drm.h>
@ -196,9 +196,10 @@ radeon_dp_aux_transfer_atom(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
tx_size = HEADER_SIZE + msg->size;
if (msg->size == 0)
tx_buf[3] |= BARE_ADDRESS_SIZE << 4;
else
else {
tx_buf[3] |= tx_size << 4;
memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size);
memcpy(tx_buf + HEADER_SIZE, msg->buffer, msg->size);
}
ret = radeon_process_aux_ch(chan,
tx_buf, tx_size, NULL, 0, delay, &ack);
if (ret >= 0)