drm/i915: Avoid mixing integer types during batch copies

Be consistent and use unsigned long throughout the chunk copies to
avoid the inherent clumsiness of mixing integer types of different
widths and signs. Failing to take acount of a wider unsigned type when
using min_t can lead to treating it as a negative, only for it flip back
to a large unsigned value after passing a boundary check.

Fixes: a4a4b6fe7dac ("drm/i915/cmdparser: Only cache the dst vmap")
Testcase: igt/gen9_exec_parse/bb-large
Reported-by: "Candelaria, Jared" <jared.candelaria@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: "Candelaria, Jared" <jared.candelaria@intel.com>
Cc: "Bloomfield, Jon" <jon.bloomfield@intel.com>
Cc: <stable@vger.kernel.org> # v4.9+
Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200928215942.31917-1-chris@chris-wilson.co.uk

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index ae63748e90bddfd7c0af9c5a62ca5bb14a0dad00..b7c4cacc36388be15e5ba0923da390357bb501fc 100644 (file)
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -2267,8 +2267,8 @@ struct eb_parse_work {
        struct i915_vma *batch;
        struct i915_vma *shadow;
        struct i915_vma *trampoline;
-       unsigned int batch_offset;
-       unsigned int batch_length;
+       unsigned long batch_offset;
+       unsigned long batch_length;
 };
 
 static int __eb_parse(struct dma_fence_work *work)
@@ -2338,6 +2338,9 @@ static int eb_parse_pipeline(struct i915_execbuffer *eb,
        struct eb_parse_work *pw;
        int err;
 
+       GEM_BUG_ON(overflows_type(eb->batch_start_offset, pw->batch_offset));
+       GEM_BUG_ON(overflows_type(eb->batch_len, pw->batch_length));
+
        pw = kzalloc(sizeof(*pw), GFP_KERNEL);
        if (!pw)
                return -ENOMEM;

diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c
index 5ac4a999f05a6ebb58ff9a8092d2a474416f97c7..e88970256e8ef3273f8337d4f2aa2b9d22d2be4c 100644 (file)
--- a/drivers/gpu/drm/i915/i915_cmd_parser.c
+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c
@@ -1136,7 +1136,7 @@ find_reg(const struct intel_engine_cs *engine, u32 addr)
 /* Returns a vmap'd pointer to dst_obj, which the caller must unmap */
 static u32 *copy_batch(struct drm_i915_gem_object *dst_obj,
                       struct drm_i915_gem_object *src_obj,
-                      u32 offset, u32 length)
+                      unsigned long offset, unsigned long length)
 {
        bool needs_clflush;
        void *dst, *src;
@@ -1166,8 +1166,8 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj,
                }
        }
        if (IS_ERR(src)) {
+               unsigned long x, n;
                void *ptr;
-               int x, n;
 
                /*
                 * We can avoid clflushing partial cachelines before the write
@@ -1184,7 +1184,7 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj,
                ptr = dst;
                x = offset_in_page(offset);
                for (n = offset >> PAGE_SHIFT; length; n++) {
-                       int len = min_t(int, length, PAGE_SIZE - x);
+                       int len = min(length, PAGE_SIZE - x);
 
                        src = kmap_atomic(i915_gem_object_get_page(src_obj, n));
                        if (needs_clflush)
@@ -1414,8 +1414,8 @@ static bool shadow_needs_clflush(struct drm_i915_gem_object *obj)
  */
 int intel_engine_cmd_parser(struct intel_engine_cs *engine,
                            struct i915_vma *batch,
-                           u32 batch_offset,
-                           u32 batch_length,
+                           unsigned long batch_offset,
+                           unsigned long batch_length,
                            struct i915_vma *shadow,
                            bool trampoline)
 {

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index ab17084af0ff40e98d276bf2802aece074f7744e..9cfc0eba4b12e575e8d559d97624479653694ef3 100644 (file)
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1931,8 +1931,8 @@ void intel_engine_init_cmd_parser(struct intel_engine_cs *engine);
 void intel_engine_cleanup_cmd_parser(struct intel_engine_cs *engine);
 int intel_engine_cmd_parser(struct intel_engine_cs *engine,
                            struct i915_vma *batch,
-                           u32 batch_offset,
-                           u32 batch_length,
+                           unsigned long batch_offset,
+                           unsigned long batch_length,
                            struct i915_vma *shadow,
                            bool trampoline);
 #define I915_CMD_PARSER_TRAMPOLINE_SIZE 8