diff options
| author | Chris Wilson <[email protected]> | 2016-12-22 08:36:26 +0000 |
|---|---|---|
| committer | Daniel Vetter <[email protected]> | 2016-12-27 14:16:59 +0100 |
| commit | c820186d5b3b213c5a627c45e5db386bb739af25 (patch) | |
| tree | 7c843d5933077c6c0f208bfa3dc498c0d198bd2e | |
| parent | ba004e39b1997bb32150961eef4a5cd02ba3edec (diff) | |
drm: Detect overflow in drm_mm_reserve_node()
Protect ourselves from a caller passing in node.start + node.size that
will overflow and trick us into reserving that node.
Signed-off-by: Chris Wilson <[email protected]>
Reviewed-by: Joonas Lahtinen <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
| -rw-r--r-- | drivers/gpu/drm/drm_mm.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c index 767cfd05c628..370cb8ee91c9 100644 --- a/drivers/gpu/drm/drm_mm.c +++ b/drivers/gpu/drm/drm_mm.c @@ -308,10 +308,9 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node) u64 hole_start, hole_end; u64 adj_start, adj_end; - if (WARN_ON(node->size == 0)) - return -EINVAL; - end = node->start + node->size; + if (unlikely(end <= node->start)) + return -ENOSPC; /* Find the relevant hole to add our node to */ hole = drm_mm_interval_tree_iter_first(&mm->interval_tree, |