UBUNTU: SAUCE: i915_bpo: drm/i915: Allow parsing of unsized batches

In "drm/i915: Add support for mandatory cmdparsing" we introduced the
concept of mandatory parsing. This allows the cmdparser to be invoked
even when user passes batch_len=0 to the execbuf ioctl's.

However, the cmdparser needs to know the extents of the buffer being
scanned. Refactor the code to ensure the cmdparser uses the actual
object size, instead of the incoming length, if user passes 0.
Signed-off-by: Jon Bloomfield <jon.bloomfield@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>

CVE-2019-0155
Signed-off-by: Timo Aaltonen <timo.aaltonen@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

ubuntu/i915/i915_gem_execbuffer.c

@@ -1603,12 +1603,17 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
 	if (use_cmdparser(engine, args->batch_len)) {
 		struct drm_i915_gem_object *parsed_batch_obj;
 
+		u32 batch_off = args->batch_start_offset;
+		u32 batch_len = args->batch_len;
+		if (batch_len == 0)
+			batch_len = batch_obj->base.size - batch_off;
+
 		parsed_batch_obj = i915_gem_execbuffer_parse(engine,
 							     &shadow_exec_entry,
 							     eb, vm,
 							     batch_obj,
-							     args->batch_start_offset,
-							     args->batch_len);
+							     batch_off,
+							     batch_len);
 		if (IS_ERR(parsed_batch_obj)) {
 			ret = PTR_ERR(parsed_batch_obj);
 			goto err;