diff options
| author | Thomas Hellstrom <thellstrom@vmware.com> | 2013-12-08 23:23:57 -0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2014-02-15 19:20:13 +0000 |
| commit | 882f85b5380e13093710f5a7ffbe575e85ba8fd8 (patch) | |
| tree | 3a960ff6c17160ebf1f4fefe99028d855473e310 | |
| parent | 536b1f2107eddfd94b7ab11a787b460b1ac4941a (diff) | |
drm/ttm: Fix accesses through vmas with only partial coverage
commit d386735588c3e22129c2bc6eb64fc1d37a8f805c upstream.
VMAs covering a bo but that didn't start at the same address space offset as
the bo they were mapping were incorrectly generating SEGFAULT errors in
the fault handler.
Reported-by: Joseph Dolinak <kanilo2@yahoo.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
[bwh: Backported to 3.2: drm_vma_node_start() is open-coded;
vma_pages() was open-coded]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/gpu/drm/ttm/ttm_bo_vm.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c index 221b924aceb..e223175a188 100644 --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c @@ -144,9 +144,9 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) } page_offset = ((address - vma->vm_start) >> PAGE_SHIFT) + - bo->vm_node->start - vma->vm_pgoff; - page_last = ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) + - bo->vm_node->start - vma->vm_pgoff; + vma->vm_pgoff - bo->vm_node->start; + page_last = vma_pages(vma) + vma->vm_pgoff - + bo->vm_node->start; if (unlikely(page_offset >= bo->num_pages)) { retval = VM_FAULT_SIGBUS; |