diff options
| author | Maarten Lankhorst <maarten.lankhorst@canonical.com> | 2013-07-07 10:40:19 +0200 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2013-07-10 10:48:07 +1000 |
| commit | 0108bc808107b97e101b15af9705729626be6447 (patch) | |
| tree | 1daa36e4937fdeca38f7efdcecb83b1e56046258 | |
| parent | 9b234db37825860b833ba110673301e2009f0546 (diff) | |
drm/nouveau: do not allow negative sizes for now
The API allows up to 64-bits allocations, but size is handled as int
inside nouveau almost everywhere. Until this is fixed it's better to
prevent negative sizes.
The 256 kB before INT_MAX is paranoia, because of the large page
aligning below that could flip it above INT_MAX.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
| -rw-r--r-- | drivers/gpu/drm/nouveau/nouveau_bo.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index 459a44550ce5..4e7ee5f4155c 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -198,6 +198,12 @@ nouveau_bo_new(struct drm_device *dev, int size, int align, size_t acc_size; int ret; int type = ttm_bo_type_device; + int max_size = INT_MAX & ~((1 << drm->client.base.vm->vmm->lpg_shift) - 1); + + if (size <= 0 || size > max_size) { + nv_warn(drm, "skipped size %x\n", (u32)size); + return -EINVAL; + } if (sg) type = ttm_bo_type_sg; |