From patchwork Tue Apr 2 02:21:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hillf Danton X-Patchwork-Id: 10881201 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5F692922 for ; Tue, 2 Apr 2019 07:44:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 465CC286DD for ; Tue, 2 Apr 2019 07:44:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3A654286F7; Tue, 2 Apr 2019 07:44:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,FREEMAIL_FROM, HTML_MESSAGE,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9715D286DD for ; Tue, 2 Apr 2019 07:44:03 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id AC99E6E6EF; Tue, 2 Apr 2019 07:43:52 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org X-Greylist: delayed 900 seconds by postgrey-1.36 at gabe; Tue, 02 Apr 2019 02:36:52 UTC Received: from mail3-166.sinamail.sina.com.cn (mail3-166.sinamail.sina.com.cn [202.108.3.166]) by gabe.freedesktop.org (Postfix) with SMTP id 7C7266E2BD for ; Tue, 2 Apr 2019 02:36:51 +0000 (UTC) Received: from unknown (HELO [IPv6:::ffff:192.168.81.85])([210.22.22.132]) by sina.com with ESMTP id 5CA2C7310000358D; Tue, 2 Apr 2019 10:21:39 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com X-SMAIL-MID: 835647394198 MIME-Version: 1.0 To: "dri-devel@lists.freedesktop.org" From: Hillf Danton Subject: [patch] drm/ttm: capture overflow of mapping boundary in ttm_bo_kmap() Date: Tue, 2 Apr 2019 10:21:38 +0800 Importance: normal X-Priority: 3 X-Mailman-Approved-At: Tue, 02 Apr 2019 07:43:52 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Junwei Zhang " , "Huang Rui " , "Christian Koenig " Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Message-Id: <20190402074352.AC99E6E6EF@gabe.freedesktop.org> X-Virus-Scanned: ClamAV using ClamSMTP Simply complain if the combined result of start_page and num_pages goes over the pages bo has. Let me know if the added warning is too heavy a hammer. Cc: Christian Koenig Cc: Huang Rui Cc: Junwei Zhang Signed-off-by: Hillf Danton --- -- --- a/drivers/gpu/drm/ttm/ttm_bo_util.c 2019-04-02 09:27:24.521761100 +0800 +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c 2019-04-02 09:37:52.108898500 +0800 @@ -631,6 +631,8 @@ int ttm_bo_kmap(struct ttm_buffer_object return -EINVAL; if (start_page > bo->num_pages) return -EINVAL; + if (WARN_ON(start_page > bo->num_pages - num_pages)) + return -EINVAL; (void) ttm_mem_io_lock(man, false); ret = ttm_mem_io_reserve(bo->bdev, &bo->mem);