Commit 96050bca authored May 02, 2012 by Christian König Committed by Dave Airlie May 03, 2012

drm/radeon: fix a bug in the SA code



Aligning offset can make it bigger than tmp->offset
leading to an overrun bug in the following subtraction.

v2: Against initial suspicions this can't happen in mainline,
    so no need to push it into stable.

Signed-off-by: Christian König <deathsimple@vodafone.de>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

parent 36abacae

drivers/gpu/drm/radeon/radeon_sa.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -150,7 +150,7 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
		offset = 0;
		list_for_each_entry(tmp, &sa_manager->sa_bo, list) {
		/* room before this object ? */
		if ((tmp->offset - offset) >= size) {
		if (offset < tmp->offset && (tmp->offset - offset) >= size) {
		head = tmp->list.prev;
		goto out;
		}