All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jani Nikula <jani.nikula@linux.intel.com>,
	Christoph Hellwig <hch@lst.de>
Cc: David Airlie <airlied@linux.ie>,
	intel-gfx@lists.freedesktop.org, kernel-janitors@vger.kernel.org,
	linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
	Chris Wilson <chris@chris-wilson.co.uk>,
	Matthew Auld <matthew.auld@intel.com>,
	Andrew Morton <akpm@linux-foundation.org>
Subject: [Intel-gfx] [PATCH] drm/i915: Fix a crash in shmem_pin_map() error handling
Date: Fri, 23 Oct 2020 14:34:01 +0300	[thread overview]
Message-ID: <20201023113401.GG282278@mwanda> (raw)

There is a signedness bug in shmem_pin_map() error handling because "i"
is unsigned.  The "while (--i >= 0)" will loop forever until the system
crashes.

Fixes: bfed6708d6c9 ("drm/i915: use vmap in shmem_pin_map")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/i915/gt/shmem_utils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/shmem_utils.c b/drivers/gpu/drm/i915/gt/shmem_utils.c
index f011ea42487e..7eb542018219 100644
--- a/drivers/gpu/drm/i915/gt/shmem_utils.c
+++ b/drivers/gpu/drm/i915/gt/shmem_utils.c
@@ -52,8 +52,9 @@ struct file *shmem_create_from_object(struct drm_i915_gem_object *obj)
 void *shmem_pin_map(struct file *file)
 {
 	struct page **pages;
-	size_t n_pages, i;
+	size_t n_pages;
 	void *vaddr;
+	int i;
 
 	n_pages = file->f_mapping->host->i_size >> PAGE_SHIFT;
 	pages = kvmalloc_array(n_pages, sizeof(*pages), GFP_KERNEL);
-- 
2.28.0

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jani Nikula <jani.nikula@linux.intel.com>,
	Christoph Hellwig <hch@lst.de>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>,
	David Airlie <airlied@linux.ie>,
	intel-gfx@lists.freedesktop.org, kernel-janitors@vger.kernel.org,
	linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
	Chris Wilson <chris@chris-wilson.co.uk>,
	Matthew Auld <matthew.auld@intel.com>,
	Rodrigo Vivi <rodrigo.vivi@intel.com>,
	Andrew Morton <akpm@linux-foundation.org>
Subject: [PATCH] drm/i915: Fix a crash in shmem_pin_map() error handling
Date: Fri, 23 Oct 2020 11:34:01 +0000	[thread overview]
Message-ID: <20201023113401.GG282278@mwanda> (raw)

There is a signedness bug in shmem_pin_map() error handling because "i"
is unsigned.  The "while (--i >= 0)" will loop forever until the system
crashes.

Fixes: bfed6708d6c9 ("drm/i915: use vmap in shmem_pin_map")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/i915/gt/shmem_utils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/shmem_utils.c b/drivers/gpu/drm/i915/gt/shmem_utils.c
index f011ea42487e..7eb542018219 100644
--- a/drivers/gpu/drm/i915/gt/shmem_utils.c
+++ b/drivers/gpu/drm/i915/gt/shmem_utils.c
@@ -52,8 +52,9 @@ struct file *shmem_create_from_object(struct drm_i915_gem_object *obj)
 void *shmem_pin_map(struct file *file)
 {
 	struct page **pages;
-	size_t n_pages, i;
+	size_t n_pages;
 	void *vaddr;
+	int i;
 
 	n_pages = file->f_mapping->host->i_size >> PAGE_SHIFT;
 	pages = kvmalloc_array(n_pages, sizeof(*pages), GFP_KERNEL);
-- 
2.28.0

WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jani Nikula <jani.nikula@linux.intel.com>,
	Christoph Hellwig <hch@lst.de>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>,
	David Airlie <airlied@linux.ie>,
	intel-gfx@lists.freedesktop.org, kernel-janitors@vger.kernel.org,
	linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
	Chris Wilson <chris@chris-wilson.co.uk>,
	Matthew Auld <matthew.auld@intel.com>,
	Rodrigo Vivi <rodrigo.vivi@intel.com>,
	Andrew Morton <akpm@linux-foundation.org>
Subject: [PATCH] drm/i915: Fix a crash in shmem_pin_map() error handling
Date: Fri, 23 Oct 2020 14:34:01 +0300	[thread overview]
Message-ID: <20201023113401.GG282278@mwanda> (raw)

There is a signedness bug in shmem_pin_map() error handling because "i"
is unsigned.  The "while (--i >= 0)" will loop forever until the system
crashes.

Fixes: bfed6708d6c9 ("drm/i915: use vmap in shmem_pin_map")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/i915/gt/shmem_utils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/shmem_utils.c b/drivers/gpu/drm/i915/gt/shmem_utils.c
index f011ea42487e..7eb542018219 100644
--- a/drivers/gpu/drm/i915/gt/shmem_utils.c
+++ b/drivers/gpu/drm/i915/gt/shmem_utils.c
@@ -52,8 +52,9 @@ struct file *shmem_create_from_object(struct drm_i915_gem_object *obj)
 void *shmem_pin_map(struct file *file)
 {
 	struct page **pages;
-	size_t n_pages, i;
+	size_t n_pages;
 	void *vaddr;
+	int i;
 
 	n_pages = file->f_mapping->host->i_size >> PAGE_SHIFT;
 	pages = kvmalloc_array(n_pages, sizeof(*pages), GFP_KERNEL);
-- 
2.28.0

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Jani Nikula <jani.nikula@linux.intel.com>,
	Christoph Hellwig <hch@lst.de>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>,
	Rodrigo Vivi <rodrigo.vivi@intel.com>,
	David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch>,
	Tvrtko Ursulin <tvrtko.ursulin@intel.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Matthew Auld <matthew.auld@intel.com>,
	Chris Wilson <chris@chris-wilson.co.uk>,
	intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] drm/i915: Fix a crash in shmem_pin_map() error handling
Date: Fri, 23 Oct 2020 14:34:01 +0300	[thread overview]
Message-ID: <20201023113401.GG282278@mwanda> (raw)

There is a signedness bug in shmem_pin_map() error handling because "i"
is unsigned.  The "while (--i >= 0)" will loop forever until the system
crashes.

Fixes: bfed6708d6c9 ("drm/i915: use vmap in shmem_pin_map")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/gpu/drm/i915/gt/shmem_utils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/shmem_utils.c b/drivers/gpu/drm/i915/gt/shmem_utils.c
index f011ea42487e..7eb542018219 100644
--- a/drivers/gpu/drm/i915/gt/shmem_utils.c
+++ b/drivers/gpu/drm/i915/gt/shmem_utils.c
@@ -52,8 +52,9 @@ struct file *shmem_create_from_object(struct drm_i915_gem_object *obj)
 void *shmem_pin_map(struct file *file)
 {
 	struct page **pages;
-	size_t n_pages, i;
+	size_t n_pages;
 	void *vaddr;
+	int i;
 
 	n_pages = file->f_mapping->host->i_size >> PAGE_SHIFT;
 	pages = kvmalloc_array(n_pages, sizeof(*pages), GFP_KERNEL);
-- 
2.28.0


             reply	other threads:[~2020-10-23 11:34 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-23 11:34 Dan Carpenter [this message]
2020-10-23 11:34 ` [PATCH] drm/i915: Fix a crash in shmem_pin_map() error handling Dan Carpenter
2020-10-23 11:34 ` Dan Carpenter
2020-10-23 11:34 ` Dan Carpenter
2020-10-23 11:36 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for " Patchwork
2020-10-23 12:19 ` [Intel-gfx] [PATCH] " Christoph Hellwig
2020-10-23 12:19   ` Christoph Hellwig
2020-10-23 12:19   ` Christoph Hellwig
2020-10-24 13:47   ` [Intel-gfx] " Dan Carpenter
2020-10-24 13:47     ` Dan Carpenter
2020-10-24 13:47     ` Dan Carpenter
2020-10-24 13:47     ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201023113401.GG282278@mwanda \
    --to=dan.carpenter@oracle.com \
    --cc=airlied@linux.ie \
    --cc=akpm@linux-foundation.org \
    --cc=chris@chris-wilson.co.uk \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=hch@lst.de \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=jani.nikula@linux.intel.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=matthew.auld@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.