drm/i915/gvt: Check if cur_pt_type is valid

Static code analyzer warns that index value for scratch_pt may be equal
to -1. Index value type is intel_gvt_gtt_type_t, so it may be any number
at range -1 to 17. Check first if cur_pt_type and cur_pt_type+1 is valid
values.

v2:
 - Print some error messages if page table type is invalid. (Colin Xu)

v4:
 - Print cur_pt_type in error message. (Colin Xu)

This patch fixed the critial issue #422 reported by klocwork.

Acked-by: Colin Xu <colin.xu@intel.com>
Signed-off-by: Aleksei Gimbitskii <aleksei.gimbitskii@intel.com>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: Zhi Wang <zhi.a.wang@intel.com>
Cc: Colin Xu <colin.xu@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>

diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index d767c45a57e2d959b05da775b8bc00af4a1a830b..3f83df533525c026da2632e572aa10a5432cb8d7 100644 (file)
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -948,7 +948,16 @@ static int ppgtt_invalidate_spt_by_shadow_entry(struct intel_vgpu *vgpu,
 
        if (e->type != GTT_TYPE_PPGTT_ROOT_L3_ENTRY
                && e->type != GTT_TYPE_PPGTT_ROOT_L4_ENTRY) {
-               cur_pt_type = get_next_pt_type(e->type) + 1;
+               cur_pt_type = get_next_pt_type(e->type);
+
+               if (!gtt_type_is_pt(cur_pt_type) ||
+                               !gtt_type_is_pt(cur_pt_type + 1)) {
+                       WARN(1, "Invalid page table type, cur_pt_type is: %d\n", cur_pt_type);
+                       return -EINVAL;
+               }
+
+               cur_pt_type += 1;
+
                if (ops->get_pfn(e) ==
                        vgpu->gtt.scratch_pt[cur_pt_type].page_mfn)
                        return 0;