lkml.org 
[lkml]   [2016]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 205/342] drm/radeon: Fix off-by-one errors in radeon_vm_bo_set_addr
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Felix Kuehling <Felix.Kuehling@amd.com>

    commit 42ef344c0994cc453477afdc7a8eadc578ed0257 upstream.

    eoffset is sometimes treated as the last address inside the address
    range, and sometimes as the first address outside the range. This
    was resulting in errors when a test filled up the entire address
    space. Make it consistent to always be the last address within the
    range. Also fixed related errors when checking the VA limit and in
    radeon_vm_fence_pts.

    Signed-off-by: Felix.Kuehling <Felix.Kuehling@amd.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/radeon/radeon_vm.c | 12 ++++++------
    1 file changed, 6 insertions(+), 6 deletions(-)

    --- a/drivers/gpu/drm/radeon/radeon_vm.c
    +++ b/drivers/gpu/drm/radeon/radeon_vm.c
    @@ -455,15 +455,15 @@ int radeon_vm_bo_set_addr(struct radeon_

    if (soffset) {
    /* make sure object fit at this offset */
    - eoffset = soffset + size;
    + eoffset = soffset + size - 1;
    if (soffset >= eoffset) {
    r = -EINVAL;
    goto error_unreserve;
    }

    last_pfn = eoffset / RADEON_GPU_PAGE_SIZE;
    - if (last_pfn > rdev->vm_manager.max_pfn) {
    - dev_err(rdev->dev, "va above limit (0x%08X > 0x%08X)\n",
    + if (last_pfn >= rdev->vm_manager.max_pfn) {
    + dev_err(rdev->dev, "va above limit (0x%08X >= 0x%08X)\n",
    last_pfn, rdev->vm_manager.max_pfn);
    r = -EINVAL;
    goto error_unreserve;
    @@ -478,7 +478,7 @@ int radeon_vm_bo_set_addr(struct radeon_
    eoffset /= RADEON_GPU_PAGE_SIZE;
    if (soffset || eoffset) {
    struct interval_tree_node *it;
    - it = interval_tree_iter_first(&vm->va, soffset, eoffset - 1);
    + it = interval_tree_iter_first(&vm->va, soffset, eoffset);
    if (it && it != &bo_va->it) {
    struct radeon_bo_va *tmp;
    tmp = container_of(it, struct radeon_bo_va, it);
    @@ -518,7 +518,7 @@ int radeon_vm_bo_set_addr(struct radeon_
    if (soffset || eoffset) {
    spin_lock(&vm->status_lock);
    bo_va->it.start = soffset;
    - bo_va->it.last = eoffset - 1;
    + bo_va->it.last = eoffset;
    list_add(&bo_va->vm_status, &vm->cleared);
    spin_unlock(&vm->status_lock);
    interval_tree_insert(&bo_va->it, &vm->va);
    @@ -888,7 +888,7 @@ static void radeon_vm_fence_pts(struct r
    unsigned i;

    start >>= radeon_vm_block_size;
    - end >>= radeon_vm_block_size;
    + end = (end - 1) >> radeon_vm_block_size;

    for (i = start; i <= end; ++i)
    radeon_bo_fence(vm->page_tables[i].bo, fence, true);
    \
     
     \ /
      Last update: 2016-03-02 01:41    [W:2.823 / U:0.908 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site