[Intel-gfx] [PATCH] drm/i915: Large page offsets for pread/pwrite
Tvrtko Ursulin
tvrtko.ursulin at linux.intel.com
Fri Oct 12 14:41:35 UTC 2018
On 12/10/2018 15:02, Chris Wilson wrote:
> Handle integer overflow when computing the sub-page length for shmem
> backed pread/pwrite.
>
> Reported-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> Cc: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
> Cc: stable at vger.kernel.org
> ---
> drivers/gpu/drm/i915/i915_gem.c | 12 ++----------
> 1 file changed, 2 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index 7d45e71100bc..93d09282710d 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -1127,11 +1127,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj,
> offset = offset_in_page(args->offset);
> for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
> struct page *page = i915_gem_object_get_page(obj, idx);
> - int length;
> -
> - length = remain;
> - if (offset + length > PAGE_SIZE)
> - length = PAGE_SIZE - offset;
> + unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
>
> ret = shmem_pread(page, offset, length, user_data,
> page_to_phys(page) & obj_do_bit17_swizzling,
> @@ -1575,11 +1571,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj,
> offset = offset_in_page(args->offset);
> for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
> struct page *page = i915_gem_object_get_page(obj, idx);
> - int length;
> -
> - length = remain;
> - if (offset + length > PAGE_SIZE)
> - length = PAGE_SIZE - offset;
> + unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
>
> ret = shmem_pwrite(page, offset, length, user_data,
> page_to_phys(page) & obj_do_bit17_swizzling,
>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
Regards,
Tvrtko
More information about the Intel-gfx
mailing list