This is a note to let you know that I've just added the patch titled drm/i915: Large page offsets for pread/pwrite to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-i915-large-page-offsets-for-pread-pwrite.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From ab0d6a141843e0b4b2709dfd37b53468b5452c3a Mon Sep 17 00:00:00 2001 From: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> Date: Fri, 12 Oct 2018 15:02:28 +0100 Subject: drm/i915: Large page offsets for pread/pwrite From: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> commit ab0d6a141843e0b4b2709dfd37b53468b5452c3a upstream. Handle integer overflow when computing the sub-page length for shmem backed pread/pwrite. Reported-by: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx> Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> Cc: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx> Link: https://patchwork.freedesktop.org/patch/msgid/20181012140228.29783-1-chris@xxxxxxxxxxxxxxxxxx (cherry picked from commit a5e856a5348f6cd50889d125c40bbeec7328e466) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/gpu/drm/i915/i915_gem.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -1122,11 +1122,7 @@ i915_gem_shmem_pread(struct drm_i915_gem offset = offset_in_page(args->offset); for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { struct page *page = i915_gem_object_get_page(obj, idx); - int length; - - length = remain; - if (offset + length > PAGE_SIZE) - length = PAGE_SIZE - offset; + unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); ret = shmem_pread(page, offset, length, user_data, page_to_phys(page) & obj_do_bit17_swizzling, @@ -1570,11 +1566,7 @@ i915_gem_shmem_pwrite(struct drm_i915_ge offset = offset_in_page(args->offset); for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { struct page *page = i915_gem_object_get_page(obj, idx); - int length; - - length = remain; - if (offset + length > PAGE_SIZE) - length = PAGE_SIZE - offset; + unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); ret = shmem_pwrite(page, offset, length, user_data, page_to_phys(page) & obj_do_bit17_swizzling, Patches currently in stable-queue which might be from chris@xxxxxxxxxxxxxxxxxx are queue-4.19/drm-i915-don-t-oops-during-modeset-shutdown-after-lpe-audio-deinit.patch queue-4.19/drm-i915-large-page-offsets-for-pread-pwrite.patch queue-4.19/drm-i915-ringbuffer-delay-after-emit_invalidate-for-gen4-gen5.patch queue-4.19/drm-i915-mark-up-gtt-sizes-as-u64.patch queue-4.19/drm-i915-compare-user-s-64b-gtt-offset-even-on-32b.patch queue-4.19/drm-i915-execlists-force-write-serialisation-into-context-image-vs-execution.patch queue-4.19/drm-i915-mark-pin-flags-as-u64.patch