[RFC 2/2] drm/i915: Handle validation of relocation object with length >=2GB
Sagar Arun Kamble
sagar.a.kamble at intel.com
Tue Feb 7 08:45:48 UTC 2017
With prefaulting extended to support >=2GB, i915 can handle
relocation objects >=2GB. type conversion of length from int to
unsigned long in access_ok was making the validation bail out with
-EFAULT.
Testcase: igt/gem_exec_reloc/wc-31
Cc: Daniel Vetter <daniel.vetter at ffwll.ch>
Cc: Chris Wilson <chris at chris-wilson.co.uk>
Signed-off-by: Sagar Arun Kamble <sagar.a.kamble at intel.com>
---
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 91c2393..db2c40e 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1159,8 +1159,8 @@ static bool only_mappable_for_reloc(unsigned int flags)
struct drm_i915_gem_exec_object2 *exec,
int count)
{
- unsigned relocs_total = 0;
- unsigned relocs_max = UINT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
+ unsigned long relocs_total = 0;
+ unsigned long relocs_max = ULONG_MAX / sizeof(struct drm_i915_gem_relocation_entry);
unsigned invalid_flags;
int i;
@@ -1173,7 +1173,7 @@ static bool only_mappable_for_reloc(unsigned int flags)
for (i = 0; i < count; i++) {
char __user *ptr = u64_to_user_ptr(exec[i].relocs_ptr);
- int length; /* limited by fault_in_pages_readable() */
+ unsigned long length;
if (exec[i].flags & invalid_flags)
return -EINVAL;
--
1.9.1
More information about the Intel-gfx-trybot
mailing list