[PATCH 2/2] drm/i915: Check that the DMA address for stolen fits within dma_addr_t

[Chris Wilson <chris@chris-wilson.co.uk>]

Just sanity check that the value we deduce from the stolen memory
register fits within the kernel's dma_addr_t and doesn't overflow.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Paulo Zanoni <paulo.r.zanoni@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
 drivers/gpu/drm/i915/i915_gem_stolen.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 42bbc4b04fd6..4f1f3090c0ed 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -211,6 +211,14 @@ static dma_addr_t i915_stolen_to_dma(struct drm_i915_private *dev_priv)
 			ggtt_start &= PGTBL_ADDRESS_LO_MASK;
 		ggtt_end = ggtt_start + ggtt_total_entries(ggtt) * 4;
 
+		if (ggtt_end <= ggtt_start ||
+		    overflows_type(ggtt_end, dma_addr_t)) {
+			DRM_ERROR("DMA address for reserved igfx memory [%llx - %llx] does not fit within the kernel's %db dma_addr_t\n",
+				  ggtt_start, ggtt_end,
+				  (int)sizeof(dma_addr_t) * 8);
+			return 0;
+		}
+
 		if (ggtt_start >= stolen[0].start && ggtt_start < stolen[0].end)
 			stolen[0].end = ggtt_start;
 		if (ggtt_end > stolen[1].start && ggtt_end <= stolen[1].end)
-- 
2.11.0

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx