Commit 8e78871b authored by Matthew Auld's avatar Matthew Auld Committed by Chris Wilson
Browse files

drm/i915/userptr: fix size calculation 



If we create a rather large userptr object(e.g 1ULL << 32) we might
shift past the type-width of num_pages: (int)num_pages << PAGE_SHIFT,
resulting in a totally bogus sg_table, which fortunately will eventually
manifest as:

gen8_ppgtt_insert_huge:463 GEM_BUG_ON(iter->sg->length < page_size)
kernel BUG at drivers/gpu/drm/i915/gt/gen8_ppgtt.c:463!

v2: more unsigned long
    prefer I915_GTT_PAGE_SIZE

Fixes: 5cc9ed4b ("drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl")
Signed-off-by: default avatarMatthew Auld <matthew.auld@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20200117132413.1170563-2-matthew.auld@intel.com
parent 24860ad7

drivers/gpu/drm/i915/gem/i915_gem_userptr.c

+5 −4
Original line number Diff line number Diff line
@@ -403,7 +403,7 @@ struct get_pages_work { 


static struct sg_table *

__i915_gem_userptr_alloc_pages(struct drm_i915_gem_object *obj,

			       struct page **pvec, int num_pages)

			       struct page **pvec, unsigned long num_pages)

{

	unsigned int max_segment = i915_sg_segment_size();

	struct sg_table *st;
@@ -449,9 +449,10 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) 
{

	struct get_pages_work *work = container_of(_work, typeof(*work), work);

	struct drm_i915_gem_object *obj = work->obj;

	const int npages = obj->base.size >> PAGE_SHIFT;

	const unsigned long npages = obj->base.size >> PAGE_SHIFT;

	unsigned long pinned;

	struct page **pvec;

	int pinned, ret;

	int ret;



	ret = -ENOMEM;

	pinned = 0;
@@ -559,7 +560,7 @@ __i915_gem_userptr_get_pages_schedule(struct drm_i915_gem_object *obj) 


static int i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj)

{

	const int num_pages = obj->base.size >> PAGE_SHIFT;

	const unsigned long num_pages = obj->base.size >> PAGE_SHIFT;

	struct mm_struct *mm = obj->userptr.mm->mm;

	struct page **pvec;

	struct sg_table *pages;

drivers/gpu/drm/i915/gt/gen6_ppgtt.c

+1 −0
Original line number Diff line number Diff line
@@ -131,6 +131,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm, 


	vaddr = kmap_atomic_px(i915_pt_entry(pd, act_pt));

	do {

		GEM_BUG_ON(iter.sg->length < I915_GTT_PAGE_SIZE);

		vaddr[act_pte] = pte_encode | GEN6_PTE_ADDR_ENCODE(iter.dma);



		iter.dma += I915_GTT_PAGE_SIZE;

drivers/gpu/drm/i915/gt/gen8_ppgtt.c

+1 −0
Original line number Diff line number Diff line
@@ -379,6 +379,7 @@ gen8_ppgtt_insert_pte(struct i915_ppgtt *ppgtt, 
	pd = i915_pd_entry(pdp, gen8_pd_index(idx, 2));

	vaddr = kmap_atomic_px(i915_pt_entry(pd, gen8_pd_index(idx, 1)));

	do {

		GEM_BUG_ON(iter->sg->length < I915_GTT_PAGE_SIZE);

		vaddr[gen8_pd_index(idx, 0)] = pte_encode | iter->dma;



		iter->dma += I915_GTT_PAGE_SIZE;

CRA Git | Maintained and supported by SUSTech CRA and CCSE