When binding pages for a partial view we should check that the offset + size is valid relative to the size of the gem object. v2: Don't use pages->nents to determine the page count (Tvrtko Ursulin) Cc: Joonas Lahtinen <joonas.lahtinen@xxxxxxxxxxxxxxx> Signed-off-by: Matthew Auld <matthew.auld@xxxxxxxxx> --- drivers/gpu/drm/i915/i915_gem_gtt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c index 7b8de85..2c49d043 100644 --- a/drivers/gpu/drm/i915/i915_gem_gtt.c +++ b/drivers/gpu/drm/i915/i915_gem_gtt.c @@ -3493,6 +3493,10 @@ intel_partial_pages(const struct i915_ggtt_view *view, struct sg_page_iter obj_sg_iter; int ret = -ENOMEM; + if (view->params.partial.offset + view->params.partial.size > + obj->base.size >> PAGE_SHIFT) + return ERR_PTR(-EINVAL); + st = kmalloc(sizeof(*st), GFP_KERNEL); if (!st) goto err_st_alloc; -- 2.4.3 _______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/intel-gfx
