Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1a97b4ac authored by Younes Manton's avatar Younes Manton Committed by Ben Skeggs
Browse files

drm/nouveau: Keep RAMIN heap within the channel. 



The entire RAMIN is allocated to be 'size', but the heap is
specified as 'base' + 'size' inside RAMIN, so it will overflow
past RAMIN by 'base' bytes on NV50+ and clobber other allocatons
unless it's size is adjusted.

Signed-off-by: default avatarYounes Manton <younes.m@gmail.com>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 26cfa813

drivers/gpu/drm/nouveau/nouveau_object.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -680,7 +680,7 @@ nouveau_gpuobj_channel_init_pramin(struct nouveau_channel *chan) 
		return ret;

		return ret;

	}

	}





	ret = drm_mm_init(&chan->ramin_heap, base, size);

	ret = drm_mm_init(&chan->ramin_heap, base, size - base);

	if (ret) {

	if (ret) {

		NV_ERROR(dev, "Error creating PRAMIN heap: %d\n", ret);

		NV_ERROR(dev, "Error creating PRAMIN heap: %d\n", ret);

		nouveau_gpuobj_ref(NULL, &chan->ramin);

		nouveau_gpuobj_ref(NULL, &chan->ramin);