Commit 96050bca authored by Christian König's avatar Christian König Committed by Dave Airlie
Browse files

drm/radeon: fix a bug in the SA code

Aligning offset can make it bigger than tmp->offset
leading to an overrun bug in the following subtraction.

v2: Against initial suspicions this can't happen in mainline,
    so no need to push it into stable.
Signed-off-by: default avatarChristian König <>
Reviewed-by: default avatarMichel Dänzer <>
Reviewed-by: default avatarJerome Glisse <>
Signed-off-by: default avatarDave Airlie <>
parent 36abacae
......@@ -150,7 +150,7 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
offset = 0;
list_for_each_entry(tmp, &sa_manager->sa_bo, list) {
/* room before this object ? */
if ((tmp->offset - offset) >= size) {
if (offset < tmp->offset && (tmp->offset - offset) >= size) {
head = tmp->list.prev;
goto out;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment