It is legal for the userspace to pass in a command stream of a size aligned to 32 bit, if that is where the last user command ends. The kernel then needs to insert a LINK command at the end of the stream, which needs to be aligned to 64 bit, so the kernel may insert an additional 32bits of padding in the stream. Align the stream size to account for that in the size and command stream validator checks.
Signed-off-by: Lucas Stach l.stach@pengutronix.de --- drivers/staging/etnaviv/etnaviv_gem_submit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/etnaviv/etnaviv_gem_submit.c b/drivers/staging/etnaviv/etnaviv_gem_submit.c index 7bd4912ab8ad..965096be5219 100644 --- a/drivers/staging/etnaviv/etnaviv_gem_submit.c +++ b/drivers/staging/etnaviv/etnaviv_gem_submit.c @@ -377,8 +377,11 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
/* * We must have space to add a LINK command at the end of - * the command buffer. + * the command buffer. Align buffer size to the next 64bit + * quantity, as that's the point where we need to insert the + * next command. */ + submit_cmd.size = ALIGN(submit_cmd.size, 8); max_size = etnaviv_obj->base.size - 8;
if (submit_cmd.size > max_size ||