From: j.glisse@gmail.com
To: dri-devel@lists.freedesktop.org
Cc: "Christian König" <deathsimple@vodafone.de>
Subject: [PATCH 06/24] drm/radeon: fix a critical bug in the SA code
Date: Wed, 25 Apr 2012 15:03:11 -0400 [thread overview]
Message-ID: <1335380609-5804-7-git-send-email-j.glisse@gmail.com> (raw)
In-Reply-To: <1335380609-5804-1-git-send-email-j.glisse@gmail.com>
From: Christian König <deathsimple@vodafone.de>
Aligning offset can make it bigger than tmp->offset
leading to an overrun bug in the following subtraction.
Signed-off-by: Christian König <deathsimple@vodafone.de>
---
drivers/gpu/drm/radeon/radeon_sa.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
index 4cce47e..8fbfe69 100644
--- a/drivers/gpu/drm/radeon/radeon_sa.c
+++ b/drivers/gpu/drm/radeon/radeon_sa.c
@@ -150,7 +150,7 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
offset = 0;
list_for_each_entry(tmp, &sa_manager->sa_bo, list) {
/* room before this object ? */
- if ((tmp->offset - offset) >= size) {
+ if (offset < tmp->offset && (tmp->offset - offset) >= size) {
head = tmp->list.prev;
goto out;
}
--
1.7.7.6
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2012-04-25 19:03 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-25 19:03 Reworking of GPU reset logic + dumping j.glisse
2012-04-25 19:03 ` [PATCH 01/24] drm/radeon: remove fence/ring/ib debugfs files j.glisse
2012-04-26 9:11 ` Christian König
2012-04-26 9:18 ` David Airlie
2012-04-26 13:36 ` Jerome Glisse
2012-04-26 13:58 ` Alex Deucher
2012-04-25 19:03 ` [PATCH 02/24] drm/radeon: make radeon_gpu_is_lockup a per ring function j.glisse
2012-04-25 19:03 ` [PATCH 03/24] drm/radeon: replace gpu_lockup with ring->ready flag j.glisse
2012-04-25 19:03 ` [PATCH 04/24] drm/radeon: use central function for IB testing j.glisse
2012-04-25 19:03 ` [PATCH 05/24] drm/radeon: rework gpu lockup detection and processing j.glisse
2012-04-25 19:03 ` j.glisse [this message]
2012-04-25 19:03 ` [PATCH 07/24] drm/radeon: add proper locking to the SA v2 j.glisse
2012-04-25 19:03 ` [PATCH 08/24] drm/radeon: add biggest hole tracking and wakequeue to the sa v4 j.glisse
2012-04-25 19:03 ` [PATCH 09/24] drm/radeon: simplify semaphore handling j.glisse
2012-04-25 19:03 ` [PATCH 10/24] drm/radeon: return -ENOENT in fence_wait_next v2 j.glisse
2012-04-25 19:03 ` [PATCH 11/24] drm/radeon: rename fence_wait_last to fence_wait_empty j.glisse
2012-04-25 19:03 ` [PATCH 12/24] drm/radeon: rip out the ib pool v2 j.glisse
2012-04-25 19:03 ` [PATCH 13/24] drm/radeon: fix a bug with the ring syncing code j.glisse
2012-04-25 19:03 ` [PATCH 14/24] drm/radeon: rework recursive gpu reset handling j.glisse
2012-04-25 19:03 ` [PATCH 15/24] drm/radeon: remove recursive mutex implementation j.glisse
2012-04-25 19:03 ` [PATCH 16/24] drm/radeon: move lockup detection code into radeon_ring.c v2 j.glisse
2012-04-25 19:03 ` [PATCH 17/24] drm/radeon: make lockup timeout a module param j.glisse
2012-04-25 19:03 ` [PATCH 18/24] drm/radeon: unlock the ring mutex while waiting for the next fence j.glisse
2012-04-25 19:03 ` [PATCH 19/24] drm/radeon: make forcing ring activity a common function j.glisse
2012-04-25 19:03 ` [PATCH 20/24] drm/radeon: remove r300_gpu_is_lockup j.glisse
2012-04-25 19:03 ` [PATCH 21/24] drm/radeon: remove cayman_gpu_is_lockup j.glisse
2012-04-25 19:03 ` [PATCH 22/24] drm/radeon: extend ring debugfs files with fence info c2 j.glisse
2012-04-25 19:03 ` [PATCH 23/24] drm/radeon: keep the cs relocs inside the ib j.glisse
2012-04-25 19:03 ` [PATCH 24/24] drm/radeon: add faulty command buffer dump facilities j.glisse
2012-04-25 21:53 ` Luca Tettamanti
2012-04-25 22:30 ` Jerome Glisse
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1335380609-5804-7-git-send-email-j.glisse@gmail.com \
--to=j.glisse@gmail.com \
--cc=deathsimple@vodafone.de \
--cc=dri-devel@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.