summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/radeon/radeon_sa.c
diff options
context:
space:
mode:
authorChristian König <deathsimple@vodafone.de>2012-05-02 13:11:14 (GMT)
committerDave Airlie <airlied@redhat.com>2012-05-03 08:16:15 (GMT)
commit96050bca22f4fe6c8db175e02c8530a9720e5e9b (patch)
treefeeb08d3e5c23e8b46891a572bd5c8b8aacf98d6 /drivers/gpu/drm/radeon/radeon_sa.c
parent36abacaed34bc1f5bcb11ca611dd3a06c5c0ef39 (diff)
downloadlinux-fsl-qoriq-96050bca22f4fe6c8db175e02c8530a9720e5e9b.tar.xz
drm/radeon: fix a bug in the SA code
Aligning offset can make it bigger than tmp->offset leading to an overrun bug in the following subtraction. v2: Against initial suspicions this can't happen in mainline, so no need to push it into stable. Signed-off-by: Christian König <deathsimple@vodafone.de> Reviewed-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/radeon/radeon_sa.c')
-rw-r--r--drivers/gpu/drm/radeon/radeon_sa.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
index 4cce47e..8fbfe69 100644
--- a/drivers/gpu/drm/radeon/radeon_sa.c
+++ b/drivers/gpu/drm/radeon/radeon_sa.c
@@ -150,7 +150,7 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
offset = 0;
list_for_each_entry(tmp, &sa_manager->sa_bo, list) {
/* room before this object ? */
- if ((tmp->offset - offset) >= size) {
+ if (offset < tmp->offset && (tmp->offset - offset) >= size) {
head = tmp->list.prev;
goto out;
}