[PATCH] drm/i915/gvt: Set up-limit of BB size to 2GB.

[Colin Xu]

Set default maximum batch buffer size to 2GB to prevent overflow.

Signed-off-by: Colin Xu <colin.xu at intel.com>
---
 drivers/gpu/drm/i915/gvt/cmd_parser.c | 6 ++++++
 drivers/gpu/drm/i915/gvt/gvt.h        | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 7c7b711942cd..02cedb34b859 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -1710,6 +1710,12 @@ static int find_bb_size(struct parser_exec_state *s, unsigned long *bb_size)
 		}
 		cmd_len = get_cmd_length(info, cmd) << 2;
 		*bb_size += cmd_len;
+		if (*bb_size > INTEL_GVT_MAX_BB_LENGTH_DEFAULT) {
+			gvt_vgpu_err("BB len exceeds max limit 0x%llx\n",
+				     INTEL_GVT_MAX_BB_LENGTH_DEFAULT);
+			*bb_size = 0;
+			return -EOVERFLOW;
+		}
 		gma += cmd_len;
 	} while (!bb_end);
 
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index b54f2bdc13a4..a5e3ec97993b 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -231,6 +231,8 @@ struct intel_vgpu {
 	u32 scan_nonprivbb;
 };
 
+#define INTEL_GVT_MAX_BB_LENGTH_DEFAULT	0x80000000
+
 /* validating GM healthy status*/
 #define vgpu_is_vm_unhealthy(ret_val) \
 	(((ret_val) == -EBADRQC) || ((ret_val) == -EFAULT))
-- 
2.21.0