From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tvrtko Ursulin Subject: Re: [Intel-gfx] [PATCH] drm/i915: Large page offsets for pread/pwrite Date: Fri, 12 Oct 2018 15:41:35 +0100 Message-ID: <7dc53bed-e3d6-632f-9eb5-689fefc02311@linux.intel.com> References: <20181012140228.29783-1-chris@chris-wilson.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20181012140228.29783-1-chris@chris-wilson.co.uk> Content-Language: en-GB Sender: stable-owner@vger.kernel.org To: Chris Wilson , intel-gfx@lists.freedesktop.org Cc: stable@vger.kernel.org List-Id: intel-gfx@lists.freedesktop.org On 12/10/2018 15:02, Chris Wilson wrote: > Handle integer overflow when computing the sub-page length for shmem > backed pread/pwrite. > > Reported-by: Tvrtko Ursulin > Signed-off-by: Chris Wilson > Cc: Tvrtko Ursulin > Cc: stable@vger.kernel.org > --- > drivers/gpu/drm/i915/i915_gem.c | 12 ++---------- > 1 file changed, 2 insertions(+), 10 deletions(-) > > diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c > index 7d45e71100bc..93d09282710d 100644 > --- a/drivers/gpu/drm/i915/i915_gem.c > +++ b/drivers/gpu/drm/i915/i915_gem.c > @@ -1127,11 +1127,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj, > offset = offset_in_page(args->offset); > for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { > struct page *page = i915_gem_object_get_page(obj, idx); > - int length; > - > - length = remain; > - if (offset + length > PAGE_SIZE) > - length = PAGE_SIZE - offset; > + unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); > > ret = shmem_pread(page, offset, length, user_data, > page_to_phys(page) & obj_do_bit17_swizzling, > @@ -1575,11 +1571,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj, > offset = offset_in_page(args->offset); > for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { > struct page *page = i915_gem_object_get_page(obj, idx); > - int length; > - > - length = remain; > - if (offset + length > PAGE_SIZE) > - length = PAGE_SIZE - offset; > + unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); > > ret = shmem_pwrite(page, offset, length, user_data, > page_to_phys(page) & obj_do_bit17_swizzling, > Reviewed-by: Tvrtko Ursulin Regards, Tvrtko