• Mika Kuoppala's avatar
    drm/i915: Fix vmap_batch page iterator overrun · 72c5ba95
    Mika Kuoppala authored
    vmap_batch() calculates amount of needed pages for the mapping
    we are going to create. And it uses this page count as an
    argument for the for_each_sg_pages() macro. The macro takes the number
    of sg list entities as an argument, not the page count. So we ended
    up iterating through all the pages on the mapped object, corrupting
    memory past the smaller pages[] array.
    
    Fix this by bailing out when we have enough pages.
    
    This regression has been introduced in
    
    commit 17cabf57
    Author: Chris Wilson <chris@chris-wilson.co.uk>
    Date:   Wed Jan 14 11:20:57 2015 +0000
    
        drm/i915: Trim the command parser allocations
    
    Cc: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: default avatarMika Kuoppala <mika.kuoppala@intel.com>
    Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
    72c5ba95
i915_cmd_parser.c 33.7 KB