On 19. 03. 20, 10:47, Gerd Hoffmann wrote:
> On Thu, Mar 19, 2020 at 10:32:25AM +0100, Jiri Slaby wrote:
>> On 05. 03. 20, 2:32, Gurchetan Singh wrote:
>>> A resource will be a shmem based resource or a (planned)
>>> vram based resource, so it makes sense to factor out common fields
>>> (resource handle, dumb).
>>>
>>> v2: move mapped field to shmem object
>>
>> Hi,
>>
>> I bisected the slab-out-of-bounds below to this patch. Is it known?
>
> No. I suspect sizeof(virtio_gpu_object) instead of
> sizeof(virtio_gpu_object_shmem) for allocation, I'll have a look ...
Ah, this?
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -123,15 +123,17 @@ bool virtio_gpu_is_shmem(struct virtio_gpu_object *bo)
struct drm_gem_object *virtio_gpu_create_object(struct drm_device *dev,
size_t size)
{
- struct virtio_gpu_object *bo;
+ struct virtio_gpu_object_shmem *shmem;
+ struct drm_gem_shmem_object *dshmem;
- bo = kzalloc(sizeof(*bo), GFP_KERNEL);
- if (!bo)
+ shmem = kzalloc(sizeof(*shmem), GFP_KERNEL);
+ if (!shmem)
return NULL;
- bo->base.base.funcs = &virtio_gpu_shmem_funcs;
- bo->base.map_cached = true;
- return &bo->base.base;
+ dshmem = &shmem->base.base;
+ dshmem->base.funcs = &virtio_gpu_shmem_funcs;
+ dshmem->map_cached = true;
+ return &dshmem->base;
}
static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,
thanks,
--
js
suse labs
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
