| Message ID | 1389610485-12084-1-git-send-email-akash.goel@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Mon, 13 Jan 2014 16:24:45 +0530 akash.goel@intel.com wrote: > From: Akash Goel <akash.goel@intel.com> > > The 'offset' field of the 'scatterlist' structure was wrongly > programmed with the offset value from the base of stolen area, > whereas this field indicates the offset from where the interested > data starts within the first PAGE pointed to by 'scattterlist' > structure. As a result when a new GEM object allocated from stolen > area is mapped to GTT, it could lead to an overwrite of GTT entries > as the page count calculation will go wrong, refer the function > 'sg_page_count'. > > v2: Modified the commit message. (Chris) > > Signed-off-by: Akash Goel <akash.goel@intel.com> > --- > drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c > index fed87ec..1a24e84 100644 > --- a/drivers/gpu/drm/i915/i915_gem_stolen.c > +++ b/drivers/gpu/drm/i915/i915_gem_stolen.c > @@ -250,7 +250,7 @@ i915_pages_create_for_stolen(struct drm_device *dev, > } > > sg = st->sgl; > - sg->offset = offset; > + sg->offset = 0; > sg->length = size; > > sg_dma_address(sg) = (dma_addr_t)dev_priv->mm.stolen_base + offset; Let's get this upstream and cc stable. Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
On Mon, Jan 27, 2014 at 04:30:41PM -0800, Jesse Barnes wrote: > On Mon, 13 Jan 2014 16:24:45 +0530 > akash.goel@intel.com wrote: > > > From: Akash Goel <akash.goel@intel.com> > > > > The 'offset' field of the 'scatterlist' structure was wrongly > > programmed with the offset value from the base of stolen area, > > whereas this field indicates the offset from where the interested > > data starts within the first PAGE pointed to by 'scattterlist' > > structure. As a result when a new GEM object allocated from stolen > > area is mapped to GTT, it could lead to an overwrite of GTT entries > > as the page count calculation will go wrong, refer the function > > 'sg_page_count'. > > > > v2: Modified the commit message. (Chris) > > > > Signed-off-by: Akash Goel <akash.goel@intel.com> > > --- > > drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c > > index fed87ec..1a24e84 100644 > > --- a/drivers/gpu/drm/i915/i915_gem_stolen.c > > +++ b/drivers/gpu/drm/i915/i915_gem_stolen.c > > @@ -250,7 +250,7 @@ i915_pages_create_for_stolen(struct drm_device *dev, > > } > > > > sg = st->sgl; > > - sg->offset = offset; > > + sg->offset = 0; > > sg->length = size; > > > > sg_dma_address(sg) = (dma_addr_t)dev_priv->mm.stolen_base + offset; > > Let's get this upstream and cc stable. > > Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org> Indeed this slipped through the cracks. Patch authors: Please poke me per mail (cc mailing lists still) or on irc if a patch seems to linger for 1-2 weeks. Merged to -fixes, thanks. -Daniel
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c index fed87ec..1a24e84 100644 --- a/drivers/gpu/drm/i915/i915_gem_stolen.c +++ b/drivers/gpu/drm/i915/i915_gem_stolen.c @@ -250,7 +250,7 @@ i915_pages_create_for_stolen(struct drm_device *dev, } sg = st->sgl; - sg->offset = offset; + sg->offset = 0; sg->length = size; sg_dma_address(sg) = (dma_addr_t)dev_priv->mm.stolen_base + offset;