drm/i915: Assert that the request->tail fits within the ring

In addition to being qword-aligned, the RING_TAIL offset must be within
the ring!

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: http://patchwork.freedesktop.org/patch/msgid/20170327130009.4678-2-chris@chris-wilson.co.uk
Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 4729ac7..47921dc 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -775,6 +775,7 @@ static void i9xx_submit_request(struct drm_i915_gem_request *request)
 	i915_gem_request_submit(request);
 
 	GEM_BUG_ON(!IS_ALIGNED(request->tail, 8));
+	GEM_BUG_ON(request->tail >= request->ring->size);
 	I915_WRITE_TAIL(request->engine, request->tail);
 }
 
@@ -787,6 +788,7 @@ static void i9xx_emit_breadcrumb(struct drm_i915_gem_request *req, u32 *cs)
 
 	req->tail = intel_ring_offset(req, cs);
 	GEM_BUG_ON(!IS_ALIGNED(req->tail, 8));
+	GEM_BUG_ON(req->tail >= req->ring->size);
 }
 
 static const int i9xx_emit_breadcrumb_sz = 4;
@@ -826,6 +828,7 @@ static void gen8_render_emit_breadcrumb(struct drm_i915_gem_request *req,
 
 	req->tail = intel_ring_offset(req, cs);
 	GEM_BUG_ON(!IS_ALIGNED(req->tail, 8));
+	GEM_BUG_ON(req->tail >= req->ring->size);
 }
 
 static const int gen8_render_emit_breadcrumb_sz = 8;