[PATCH 12/91] drm/i915: Use range_overflows()

[Tvrtko Ursulin]

On 05/01/2017 10:34, Chris Wilson wrote:
> Replace a few more open-coded overflow checks with the macro.
>
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> ---
>  drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +-
>  drivers/gpu/drm/i915/i915_vma.c        | 3 ++-
>  drivers/gpu/drm/i915/intel_bios.c      | 7 +++++--
>  3 files changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
> index 112ca930ea4c..5fd851336a99 100644
> --- a/drivers/gpu/drm/i915/i915_gem_stolen.c
> +++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
> @@ -502,7 +502,7 @@ i915_pages_create_for_stolen(struct drm_device *dev,
>  	struct sg_table *st;
>  	struct scatterlist *sg;
>
> -	GEM_BUG_ON(offset > dev_priv->ggtt.stolen_size - size);
> +	GEM_BUG_ON(range_overflows(offset, size, dev_priv->ggtt.stolen_size));
>
>  	/* We hide that we have no struct page backing our stolen object
>  	 * by wrapping the contiguous physical allocation with a fake
> diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
> index d48c68214611..58f2483362ad 100644
> --- a/drivers/gpu/drm/i915/i915_vma.c
> +++ b/drivers/gpu/drm/i915/i915_vma.c
> @@ -403,7 +403,8 @@ i915_vma_insert(struct i915_vma *vma, u64 size, u64 alignment, u64 flags)
>
>  	if (flags & PIN_OFFSET_FIXED) {
>  		u64 offset = flags & PIN_OFFSET_MASK;
> -		if (offset & (alignment - 1) || offset > end - size) {
> +		if (offset & (alignment - 1) ||
> +		    range_overflows(offset, size, end)) {
>  			ret = -EINVAL;
>  			goto err_unpin;
>  		}
> diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
> index f6d37558301d..e144f033f4b5 100644
> --- a/drivers/gpu/drm/i915/intel_bios.c
> +++ b/drivers/gpu/drm/i915/intel_bios.c
> @@ -1416,13 +1416,16 @@ bool intel_bios_is_valid_vbt(const void *buf, size_t size)
>  		return false;
>  	}
>
> -	if (vbt->bdb_offset + sizeof(struct bdb_header) > size) {
> +	if (range_overflows_t(size_t,
> +			      vbt->bdb_offset,
> +			      sizeof(struct bdb_header),
> +			      size)) {
>  		DRM_DEBUG_DRIVER("BDB header incomplete\n");
>  		return false;
>  	}
>
>  	bdb = get_bdb_header(vbt);
> -	if (vbt->bdb_offset + bdb->bdb_size > size) {
> +	if (range_overflows_t(size_t, vbt->bdb_offset, bdb->bdb_size, size)) {
>  		DRM_DEBUG_DRIVER("BDB incomplete\n");
>  		return false;
>  	}
>

Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>

Regards,

Tvrtko