From fbfa754e8dce1553e024310eb7b7ed9469ed238b Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Fri, 29 Aug 2014 19:28:34 +0100 Subject: lib/batchbuffer: Guard intel_blt_copy with even more asserts Assert that the source/destination bounds are within the pitch and size of the associated bo. Signed-off-by: Chris Wilson --- lib/intel_batchbuffer.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) (limited to 'lib/intel_batchbuffer.c') diff --git a/lib/intel_batchbuffer.c b/lib/intel_batchbuffer.c index 84c4c538..b4598fbf 100644 --- a/lib/intel_batchbuffer.c +++ b/lib/intel_batchbuffer.c @@ -311,6 +311,20 @@ intel_blt_copy(struct intel_batchbuffer *batch, uint32_t cmd_bits = 0; uint32_t br13_bits; +#define CHECK_RANGE(x) ((x) >= 0 && (x) < (1 << 15)) + igt_assert(CHECK_RANGE(src_x1) && CHECK_RANGE(src_y1) && + CHECK_RANGE(dst_x1) && CHECK_RANGE(dst_y1) && + CHECK_RANGE(width) && CHECK_RANGE(height) && + CHECK_RANGE(src_x1 + width) && CHECK_RANGE(src_y1 + height) + && CHECK_RANGE(dst_x1 + width) && CHECK_RANGE(dst_y1 + + height) && + CHECK_RANGE(src_pitch) && CHECK_RANGE(dst_pitch)); +#undef CHECK_RANGE + igt_assert(bpp*(src_x1 + width) <= 8*src_pitch); + igt_assert(bpp*(dst_x1 + width) <= 8*dst_pitch); + igt_assert(src_pitch * (src_y1 + height) <= src_bo->size); + igt_assert(dst_pitch * (dst_y1 + height) <= dst_bo->size); + drm_intel_bo_get_tiling(src_bo, &src_tiling, &swizzle); drm_intel_bo_get_tiling(dst_bo, &dst_tiling, &swizzle); @@ -340,16 +354,6 @@ intel_blt_copy(struct intel_batchbuffer *batch, igt_fail(1); } -#define CHECK_RANGE(x) ((x) >= 0 && (x) < (1 << 15)) - igt_assert(CHECK_RANGE(src_x1) && CHECK_RANGE(src_y1) && - CHECK_RANGE(dst_x1) && CHECK_RANGE(dst_y1) && - CHECK_RANGE(width) && CHECK_RANGE(height) && - CHECK_RANGE(src_x1 + width) && CHECK_RANGE(src_y1 + height) - && CHECK_RANGE(dst_x1 + width) && CHECK_RANGE(dst_y1 + - height) && - CHECK_RANGE(src_pitch) && CHECK_RANGE(dst_pitch)); -#undef CHECK_RANGE - BEGIN_BATCH(gen >= 8 ? 10 : 8); OUT_BATCH(XY_SRC_COPY_BLT_CMD | cmd_bits | (gen >= 8 ? 8 : 6)); -- cgit v1.2.3