Skip to content

Commit 65b3bdc

Browse files
icklejlahtine-intel
authored andcommitted
drm/i915/query: nospec expects no more than an unsigned long
nospec quite reasonably asserts that it will never be used with an index larger than unsigned long (that being the largest possibly index into an C array). However, our ubi uses the convention of u64 for any large integer, running afoul of the assertion on 32b. Reduce our index to an unsigned long, checking for type overflow first. drivers/gpu/drm/i915/i915_query.c: In function 'i915_query_ioctl': include/linux/compiler.h:339:38: error: call to '__compiletime_assert_119' declared with attribute error: BUILD_BUG_ON failed: sizeof(_s) > sizeof(long) Reported-by: [email protected] Fixes: 84b510e ("drm/i915/query: Protect tainted function pointer lookup") Signed-off-by: Chris Wilson <[email protected]> Cc: Lionel Landwerlin <[email protected]> Cc: Joonas Lahtinen <[email protected]> Cc: Tvrtko Ursulin <[email protected]> Reviewed-by: Lionel Landwerlin <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected] (cherry picked from commit a33b1dc) Signed-off-by: Joonas Lahtinen <[email protected]>
1 parent 540ead8 commit 65b3bdc

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

drivers/gpu/drm/i915/i915_query.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
102102

103103
for (i = 0; i < args->num_items; i++, user_item_ptr++) {
104104
struct drm_i915_query_item item;
105-
u64 func_idx;
105+
unsigned long func_idx;
106106
int ret;
107107

108108
if (copy_from_user(&item, user_item_ptr, sizeof(item)))
@@ -111,6 +111,9 @@ int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
111111
if (item.query_id == 0)
112112
return -EINVAL;
113113

114+
if (overflows_type(item.query_id - 1, unsigned long))
115+
return -EINVAL;
116+
114117
func_idx = item.query_id - 1;
115118

116119
ret = -EINVAL;

0 commit comments

Comments
 (0)