[PATCH v3 1/2] drm/virtio: factor out the sg_table from virtio_gpu_object

[Jiri Slaby]

On 19. 03. 20, 10:47, Gerd Hoffmann wrote:
> On Thu, Mar 19, 2020 at 10:32:25AM +0100, Jiri Slaby wrote:
>> On 05. 03. 20, 2:32, Gurchetan Singh wrote:
>>> A resource will be a shmem based resource or a (planned)
>>> vram based resource, so it makes sense to factor out common fields
>>> (resource handle, dumb).
>>>
>>> v2: move mapped field to shmem object
>>
>> Hi,
>>
>> I bisected the slab-out-of-bounds below to this patch. Is it known?
> 
> No.  I suspect sizeof(virtio_gpu_object) instead of
> sizeof(virtio_gpu_object_shmem) for allocation, I'll have a look ...

Ah, this?
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -123,15 +123,17 @@ bool virtio_gpu_is_shmem(struct virtio_gpu_object *bo)
 struct drm_gem_object *virtio_gpu_create_object(struct drm_device *dev,
                                                size_t size)
 {
-       struct virtio_gpu_object *bo;
+       struct virtio_gpu_object_shmem *shmem;
+       struct drm_gem_shmem_object *dshmem;

-       bo = kzalloc(sizeof(*bo), GFP_KERNEL);
-       if (!bo)
+       shmem = kzalloc(sizeof(*shmem), GFP_KERNEL);
+       if (!shmem)
                return NULL;

-       bo->base.base.funcs = &virtio_gpu_shmem_funcs;
-       bo->base.map_cached = true;
-       return &bo->base.base;
+       dshmem = &shmem->base.base;
+       dshmem->base.funcs = &virtio_gpu_shmem_funcs;
+       dshmem->map_cached = true;
+       return &dshmem->base;
 }

 static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,

thanks,
-- 
js
suse labs