diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2016-12-22 08:36:26 +0000 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2016-12-27 14:16:59 +0100 |
| commit | c820186d5b3b213c5a627c45e5db386bb739af25 (patch) | |
| tree | 7c843d5933077c6c0f208bfa3dc498c0d198bd2e /drivers/gpu/drm | |
| parent | ba004e39b1997bb32150961eef4a5cd02ba3edec (diff) | |
| download | linux-stable-c820186d5b3b213c5a627c45e5db386bb739af25.tar.gz linux-stable-c820186d5b3b213c5a627c45e5db386bb739af25.tar.bz2 linux-stable-c820186d5b3b213c5a627c45e5db386bb739af25.zip | |
drm: Detect overflow in drm_mm_reserve_node()
Protect ourselves from a caller passing in node.start + node.size that
will overflow and trick us into reserving that node.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/20161222083641.2691-24-chris@chris-wilson.co.uk
Diffstat (limited to 'drivers/gpu/drm')
| -rw-r--r-- | drivers/gpu/drm/drm_mm.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c index 767cfd05c628..370cb8ee91c9 100644 --- a/drivers/gpu/drm/drm_mm.c +++ b/drivers/gpu/drm/drm_mm.c @@ -308,10 +308,9 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node) u64 hole_start, hole_end; u64 adj_start, adj_end; - if (WARN_ON(node->size == 0)) - return -EINVAL; - end = node->start + node->size; + if (unlikely(end <= node->start)) + return -ENOSPC; /* Find the relevant hole to add our node to */ hole = drm_mm_interval_tree_iter_first(&mm->interval_tree, |