[Intel-gfx] [PATCH] drm/i915: Fix vmap_batch page iterator overrun

[Chris Wilson]

On Fri, Mar 13, 2015 at 03:21:53PM +0200, Mika Kuoppala wrote:
> vmap_batch() calculates amount of needed pages for the mapping
> we are going to create. And it uses this page count as an
> argument for the for_each_sg_pages() macro. The macro takes the number
> of sg list entities as an argument, not the page count. So we ended
> up iterating through all the pages on the mapped object, corrupting
> memory past the smaller pages[] array.
> 
> Fix this by bailing out when we have enough pages.
> 
> Cc: Chris Wilson <chris at chris-wilson.co.uk>
> Signed-off-by: Mika Kuoppala <mika.kuoppala at intel.com>
Reviewed-by: Chris Wilson <chris at chris-wilson.co.uk>

Can I ask for a st_for_each_page(&obj->pages, &sg_iter, n)?

That would simplify all of our users, and stop me from making the same
mistake again.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre