| Message ID | 20190408131310.3130-2-christian.koenig@amd.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/2] drm/ttm: fix out-of-bounds read in ttm_put_pages() v2 | expand |
> -----Original Message----- > From: Christian König [mailto:ckoenig.leichtzumerken@gmail.com] > Sent: Monday, April 08, 2019 9:13 PM > To: Zhang, Jerry <Jerry.Zhang@amd.com>; Huang, Ray > <Ray.Huang@amd.com>; amd-gfx@lists.freedesktop.org; dri- > devel@lists.freedesktop.org > Subject: [PATCH 2/2] drm/ttm: fix start page for huge page check in > ttm_put_pages() > > The first page entry is always the same with itself. > > Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Huang Rui <ray.huang@amd.com> > --- > drivers/gpu/drm/ttm/ttm_page_alloc.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c > b/drivers/gpu/drm/ttm/ttm_page_alloc.c > index f77c81db161b..c74147f0cbe3 100644 > --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c > +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c > @@ -732,7 +732,7 @@ static void ttm_put_pages(struct page **pages, > unsigned npages, int flags, #ifdef CONFIG_TRANSPARENT_HUGEPAGE > if (!(flags & TTM_PAGE_FLAG_DMA32) && > (npages - i) >= HPAGE_PMD_NR) { > - for (j = 0; j < HPAGE_PMD_NR; ++j) > + for (j = 1; j < HPAGE_PMD_NR; ++j) > if (p++ != pages[i + j]) > break; > > @@ -767,7 +767,7 @@ static void ttm_put_pages(struct page **pages, > unsigned npages, int flags, > if (!p) > break; > > - for (j = 0; j < HPAGE_PMD_NR; ++j) > + for (j = 1; j < HPAGE_PMD_NR; ++j) > if (p++ != pages[i + j]) > break; > > -- > 2.17.1
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c index f77c81db161b..c74147f0cbe3 100644 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c @@ -732,7 +732,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, #ifdef CONFIG_TRANSPARENT_HUGEPAGE if (!(flags & TTM_PAGE_FLAG_DMA32) && (npages - i) >= HPAGE_PMD_NR) { - for (j = 0; j < HPAGE_PMD_NR; ++j) + for (j = 1; j < HPAGE_PMD_NR; ++j) if (p++ != pages[i + j]) break; @@ -767,7 +767,7 @@ static void ttm_put_pages(struct page **pages, unsigned npages, int flags, if (!p) break; - for (j = 0; j < HPAGE_PMD_NR; ++j) + for (j = 1; j < HPAGE_PMD_NR; ++j) if (p++ != pages[i + j]) break;
The first page entry is always the same with itself. Signed-off-by: Christian König <christian.koenig@amd.com> --- drivers/gpu/drm/ttm/ttm_page_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)