Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ab0d6a14 authored by Chris Wilson's avatar Chris Wilson Committed by Rodrigo Vivi
Browse files

drm/i915: Large page offsets for pread/pwrite 



Handle integer overflow when computing the sub-page length for shmem
backed pread/pwrite.

Reported-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20181012140228.29783-1-chris@chris-wilson.co.uk


(cherry picked from commit a5e856a5)
Signed-off-by: default avatarRodrigo Vivi <rodrigo.vivi@intel.com>
parent e3118a03

drivers/gpu/drm/i915/i915_gem.c

+2 −10
Original line number Diff line number Diff line
@@ -1127,11 +1127,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj, 
	offset = offset_in_page(args->offset);

	for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {

		struct page *page = i915_gem_object_get_page(obj, idx);

		int length;



		length = remain;

		if (offset + length > PAGE_SIZE)

			length = PAGE_SIZE - offset;

		unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);



		ret = shmem_pread(page, offset, length, user_data,

				  page_to_phys(page) & obj_do_bit17_swizzling,
@@ -1575,11 +1571,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj, 
	offset = offset_in_page(args->offset);

	for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {

		struct page *page = i915_gem_object_get_page(obj, idx);

		int length;



		length = remain;

		if (offset + length > PAGE_SIZE)

			length = PAGE_SIZE - offset;

		unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);



		ret = shmem_pwrite(page, offset, length, user_data,

				   page_to_phys(page) & obj_do_bit17_swizzling,