Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 66c0255c authored by Gerd Hoffmann's avatar Gerd Hoffmann Committed by Sean Paul
Browse files

qxl: fix qxl_release_{map,unmap} 



s/PAGE_SIZE/PAGE_MASK/

Luckily release_offset is never larger than PAGE_SIZE, so the bug has no
bad side effects and managed to stay unnoticed for years that way ...

Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: default avatarDave Airlie <airlied@redhat.com>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20180418054257.15388-2-kraxel@redhat.com


Signed-off-by: default avatarSean Paul <seanpaul@chromium.org>
parent ab170c27

drivers/gpu/drm/qxl/qxl_ioctl.c

+2 −2
Original line number Diff line number Diff line
@@ -182,9 +182,9 @@ static int qxl_process_single_command(struct qxl_device *qdev, 
		goto out_free_reloc;



	/* TODO copy slow path code from i915 */

	fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));

	fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_MASK));

	unwritten = __copy_from_user_inatomic_nocache

		(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE),

		(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_MASK),

		 u64_to_user_ptr(cmd->command), cmd->command_size);



	{

drivers/gpu/drm/qxl/qxl_release.c

+3 −3
Original line number Diff line number Diff line
@@ -411,10 +411,10 @@ union qxl_release_info *qxl_release_map(struct qxl_device *qdev, 
	struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);

	struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);



	ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_SIZE);

	ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_MASK);

	if (!ptr)

		return NULL;

	info = ptr + (release->release_offset & ~PAGE_SIZE);

	info = ptr + (release->release_offset & ~PAGE_MASK);

	return info;

}
@@ -426,7 +426,7 @@ void qxl_release_unmap(struct qxl_device *qdev, 
	struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);

	void *ptr;



	ptr = ((void *)info) - (release->release_offset & ~PAGE_SIZE);

	ptr = ((void *)info) - (release->release_offset & ~PAGE_MASK);

	qxl_bo_kunmap_atomic_page(qdev, bo, ptr);

}