Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f1cc993 authored by Chris Wilson's avatar Chris Wilson Committed by Daniel Vetter
Browse files

drm/i915: Avoid dereference past end of page array in gen8_ppgtt_insert_entries() 



The bug from gen6_ppgtt_insert_entries() was replicated into
gen8_ppgtt_insert_entries(). This applies the fix for the OOPS from the
previous patch to the gen8 routine.

Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Ben Widawsky <benjamin.widawsky@intel.com>
Reviewed-by: default avatarBen Widawsky <ben@bwidawsk.net>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent cc79714f

drivers/gpu/drm/i915/i915_gem_gtt.c

+9 −9
Original line number Diff line number Diff line
@@ -297,22 +297,22 @@ static void gen8_ppgtt_insert_entries(struct i915_address_space *vm, 
	unsigned act_pte = first_entry % GEN8_PTES_PER_PAGE;

	struct sg_page_iter sg_iter;



	pt_vaddr = kmap_atomic(&ppgtt->gen8_pt_pages[act_pt]);

	pt_vaddr = NULL;

	for_each_sg_page(pages->sgl, &sg_iter, pages->nents, 0) {

		dma_addr_t page_addr;

		if (pt_vaddr == NULL)

			pt_vaddr = kmap_atomic(&ppgtt->gen8_pt_pages[act_pt]);



		page_addr = sg_dma_address(sg_iter.sg) +

				(sg_iter.sg_pgoffset << PAGE_SHIFT);

		pt_vaddr[act_pte] = gen8_pte_encode(page_addr, cache_level,

						    true);

		pt_vaddr[act_pte] =

			gen8_pte_encode(sg_page_iter_dma_address(&sg_iter),

					cache_level, true);

		if (++act_pte == GEN8_PTES_PER_PAGE) {

			kunmap_atomic(pt_vaddr);

			pt_vaddr = NULL;

			act_pt++;

			pt_vaddr = kmap_atomic(&ppgtt->gen8_pt_pages[act_pt]);

			act_pte = 0;



		}

	}

	if (pt_vaddr)

		kunmap_atomic(pt_vaddr);

}