diff options
| author | Matthew Wilcox (Oracle) <willy@infradead.org> | 2023-10-05 14:56:47 +0100 |
|---|---|---|
| committer | Maxime Ripard <mripard@kernel.org> | 2023-10-12 10:44:06 +0200 |
| commit | b7fd68ab1538e3adb665670414bea440f399fda9 (patch) | |
| tree | 5c23ec8ae85f915b2f05a40a9e1f9cb85e42f958 /drivers/gpu/drm/tiny | |
| parent | 2b7947bd32e243c52870d54141d3b4ea6775e63d (diff) | |
drm: Do not overrun array in drm_gem_get_pages()
If the shared memory object is larger than the DRM object that it backs,
we can overrun the page array. Limit the number of pages we install
from each folio to prevent this.
Signed-off-by: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Link: https://lore.kernel.org/lkml/13360591.uLZWGnKmhe@natalenko.name/
Fixes: 3291e09a4638 ("drm: convert drm_gem_put_pages() to use a folio_batch")
Cc: stable@vger.kernel.org # 6.5.x
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231005135648.2317298-1-willy@infradead.org
Diffstat (limited to 'drivers/gpu/drm/tiny')
0 files changed, 0 insertions, 0 deletions