From patchwork Thu Dec 22 08:36:26 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 9484491 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0914E601D3 for ; Thu, 22 Dec 2016 08:41:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 05B21277D9 for ; Thu, 22 Dec 2016 08:41:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EEEF4281C3; Thu, 22 Dec 2016 08:41:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BACBF277D9 for ; Thu, 22 Dec 2016 08:41:36 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id DC1E76F19F; Thu, 22 Dec 2016 08:41:25 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wm0-x241.google.com (mail-wm0-x241.google.com [IPv6:2a00:1450:400c:c09::241]) by gabe.freedesktop.org (Postfix) with ESMTPS id 91E8E6F174; Thu, 22 Dec 2016 08:37:11 +0000 (UTC) Received: by mail-wm0-x241.google.com with SMTP id g23so34811146wme.1; Thu, 22 Dec 2016 00:37:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=D1OCsQmQeif4FVNj4WJOSVZez72QH0nIZzJqKoCehD8=; b=SAEYA5JymzJA/2ZsYvXNnGS/bzPQvipqOBPmr0q4chfwzTOn9xnN2QZRLYFlvkk2ji uTEqUlQ7nXaOOQqm2xjenZdx7hRtCJAa72/irNBp39/lSY1SFcNnMlMhTWI6IFwssO2e L9Ix4l0sG4+Nr5rXFpx1dyGTzF7oZipTJhEKWcA0DP+edNzE3geLOXz/pkOtUXOqy19U gouB9c2ovBd/PJv2jSTxIqvZEtJAYbknswY387ZjuQnmQYk595pzJyv6p7SCSDY144Yd dH6TxLdB+KOZp6inLuTnTYpJ2zfL3MgGwCo7QZjph50wQuCxUTZYGLoI+U5hakAe4FzM ji8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=D1OCsQmQeif4FVNj4WJOSVZez72QH0nIZzJqKoCehD8=; b=nThGZEZO8PX4areVlvq9qYmff9t57uiSUGV7l66kIsca7Tz7K2j3Tv8X6n9NBX4pHV NceW7N+pWkXFT3WbJzCw4rD75XSD972lKw0GYs0/G4qbClOlOZYLZeck0kfH2q3UjloQ D5R3nxbNrBgO/R85QBb4/ORrNaCCxQYDRq26o7kb+BIYumC5ImRoYK4/Q9V2Fe0+gJzY PUuWTcQWULYXHeNxhFKQIdGoVdDSrOB0CljQY4pwPfPFl2AR62eh18iUOTwGcjB3e8Nl GQK8QS9fNnkrltqsXWXew2mrPsn/vZ3xjr2TWS9/CxBsea8SHx4EkAJhKCjxtea71PSK YWMg== X-Gm-Message-State: AIkVDXKhgwm0/jqMtEoDb+LhXy+rswXC0S+bj11cchvQ/TJKxhqw+guRAlVQwvOkUPlE+A== X-Received: by 10.28.56.132 with SMTP id f126mr5675276wma.126.1482395829540; Thu, 22 Dec 2016 00:37:09 -0800 (PST) Received: from haswell.alporthouse.com ([78.156.65.138]) by smtp.gmail.com with ESMTPSA id di9sm34442318wjc.37.2016.12.22.00.37.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 22 Dec 2016 00:37:08 -0800 (PST) From: Chris Wilson To: dri-devel@lists.freedesktop.org Subject: [PATCH v4 23/38] drm: Detect overflow in drm_mm_reserve_node() Date: Thu, 22 Dec 2016 08:36:26 +0000 Message-Id: <20161222083641.2691-24-chris@chris-wilson.co.uk> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20161222083641.2691-1-chris@chris-wilson.co.uk> References: <20161222083641.2691-1-chris@chris-wilson.co.uk> Cc: intel-gfx@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Protect ourselves from a caller passing in node.start + node.size that will overflow and trick us into reserving that node. Signed-off-by: Chris Wilson Reviewed-by: Joonas Lahtinen --- drivers/gpu/drm/drm_mm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c index 767cfd05c628..370cb8ee91c9 100644 --- a/drivers/gpu/drm/drm_mm.c +++ b/drivers/gpu/drm/drm_mm.c @@ -308,10 +308,9 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node) u64 hole_start, hole_end; u64 adj_start, adj_end; - if (WARN_ON(node->size == 0)) - return -EINVAL; - end = node->start + node->size; + if (unlikely(end <= node->start)) + return -ENOSPC; /* Find the relevant hole to add our node to */ hole = drm_mm_interval_tree_iter_first(&mm->interval_tree,