openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-05-01 01:27:08 +00:00
Code Issues Projects Releases Wiki Activity

drm/i915: Fix potential overflow of shmem scatterlist length

Browse Source 
From Janusz Krzysztofik
eae4bf4107571283031db96ce132e951615e2ae4 in linux-6.18.y/6.18.19
029ae067431ab9d0fca479bdabe780fa436706ea in mainline linux
This commit is contained in:
jsg
2026-03-20 00:30:08 +00:00
parent b3f1d4030f
commit 2c4ecfc8b1
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
sys/dev/pci/drm/i915/gem/i915_gem_shmem.c
View File

@@ -170,8 +170,12 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
}
} while (1);
nr_pages = min_t(unsigned long,
folio_nr_pages(folio), page_count - i);
nr_pages = min_array(((unsigned long[]) {
folio_nr_pages(folio),
page_count - i,
max_segment / PAGE_SIZE,
}), 3);
if (!i ||
sg->length >= max_segment ||
folio_pfn(folio) != next_pfn) {
@@ -181,7 +185,9 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
st->nents++;
sg_set_folio(sg, folio, nr_pages * PAGE_SIZE, 0);
} else {
/* XXX: could overflow? */
nr_pages = min_t(unsigned long, nr_pages,
(max_segment - sg->length) / PAGE_SIZE);
sg->length += nr_pages * PAGE_SIZE;
}
next_pfn = folio_pfn(folio) + nr_pages;