[Intel-gfx] [PATCH] drm_calloc_large: check right size, check integer overflow, use GFP_ZERO

[Kristian Høgsberg]

Eric, can you pick this one up?  I've seen several cases of rendering
corruption with higher order allocation errors coming from
drm_calloc_large() in dmesg.

thanks,
Kristian

On Mon, Jun 8, 2009 at 8:18 PM, Jesse Barnes<jbarnes at virtuousgeek.org> wrote:
> On Mon,  8 Jun 2009 11:50:41 -0400
> Kristian Høgsberg <krh at bitplanet.net> wrote:
>
>> From: Kristian Høgsberg <krh at redhat.com>
>>
>> Previously we would check size instead of size * nmemb, and so would
>> never hit the vmalloc path.  Also add integer overflow check as in
>> kcalloc, and allocate GFP_ZERO pages instead of memset()ing them.
>>
>> Signed-off-by: Kristian Høgsberg <krh at redhat.com>
>> ---
>>
>> Oops...
>>
>>  include/drm/drmP.h |   12 ++++--------
>>  1 files changed, 4 insertions(+), 8 deletions(-)
>>
>> diff --git a/include/drm/drmP.h b/include/drm/drmP.h
>> index b84d8ae..4660e46 100644
>> --- a/include/drm/drmP.h
>> +++ b/include/drm/drmP.h
>> @@ -1522,18 +1522,14 @@ static __inline__ void *drm_calloc(size_t
>> nmemb, size_t size, int area)
>>  static __inline__ void *drm_calloc_large(size_t nmemb, size_t size)
>>  {
>> -     u8 *addr;
>> -
>> -     if (size <= PAGE_SIZE)
>> +     if (size * nmemb <= PAGE_SIZE)
>>           return kcalloc(nmemb, size, GFP_KERNEL);
>>
>> -     addr = vmalloc(nmemb * size);
>> -     if (!addr)
>> +     if (size != 0 && nmemb > ULONG_MAX / size)
>>               return NULL;
>>
>> -     memset(addr, 0, nmemb * size);
>> -
>> -     return addr;
>> +     return __vmalloc(size * nmemb,
>> +                      GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
>> PAGE_KERNEL); }
>>
>>  static __inline void drm_free_large(void *ptr)
>
> I fail at calloc.  Thanks Kristian.  Now has someone actually tested
> and found that this removes the "order N allocation failure" messages
> from their logs this time?
>
> Acked-by: Jesse Barnes <jbarnes at virtuousgeek.org>
>