summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/drm_mm.c
diff options
context:
space:
mode:
authorChris Wilson <chris@chris-wilson.co.uk>2016-12-22 11:36:26 +0300
committerDaniel Vetter <daniel.vetter@ffwll.ch>2016-12-27 16:16:59 +0300
commitc820186d5b3b213c5a627c45e5db386bb739af25 (patch)
tree7c843d5933077c6c0f208bfa3dc498c0d198bd2e /drivers/gpu/drm/drm_mm.c
parentba004e39b1997bb32150961eef4a5cd02ba3edec (diff)
downloadlinux-c820186d5b3b213c5a627c45e5db386bb739af25.tar.xz
drm: Detect overflow in drm_mm_reserve_node()
Protect ourselves from a caller passing in node.start + node.size that will overflow and trick us into reserving that node. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20161222083641.2691-24-chris@chris-wilson.co.uk
Diffstat (limited to 'drivers/gpu/drm/drm_mm.c')
-rw-r--r--drivers/gpu/drm/drm_mm.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 767cfd05c628..370cb8ee91c9 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -308,10 +308,9 @@ int drm_mm_reserve_node(struct drm_mm *mm, struct drm_mm_node *node)
u64 hole_start, hole_end;
u64 adj_start, adj_end;
- if (WARN_ON(node->size == 0))
- return -EINVAL;
-
end = node->start + node->size;
+ if (unlikely(end <= node->start))
+ return -ENOSPC;
/* Find the relevant hole to add our node to */
hole = drm_mm_interval_tree_iter_first(&mm->interval_tree,