mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 03:10:12 +00:00
qxl: fix qxl_release_{map,unmap}
s/PAGE_SIZE/PAGE_MASK/ Luckily release_offset is never larger than PAGE_SIZE, so the bug has no bad side effects and managed to stay unnoticed for years that way ... Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180418054257.15388-2-kraxel@redhat.com Signed-off-by: Sean Paul <seanpaul@chromium.org>
This commit is contained in:
parent
ab170c2736
commit
66c0255cf5
2 changed files with 5 additions and 5 deletions
|
@ -182,9 +182,9 @@ static int qxl_process_single_command(struct qxl_device *qdev,
|
|||
goto out_free_reloc;
|
||||
|
||||
/* TODO copy slow path code from i915 */
|
||||
fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
|
||||
fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_MASK));
|
||||
unwritten = __copy_from_user_inatomic_nocache
|
||||
(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE),
|
||||
(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_MASK),
|
||||
u64_to_user_ptr(cmd->command), cmd->command_size);
|
||||
|
||||
{
|
||||
|
|
|
@ -411,10 +411,10 @@ union qxl_release_info *qxl_release_map(struct qxl_device *qdev,
|
|||
struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
|
||||
struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
|
||||
|
||||
ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_SIZE);
|
||||
ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_MASK);
|
||||
if (!ptr)
|
||||
return NULL;
|
||||
info = ptr + (release->release_offset & ~PAGE_SIZE);
|
||||
info = ptr + (release->release_offset & ~PAGE_MASK);
|
||||
return info;
|
||||
}
|
||||
|
||||
|
@ -426,7 +426,7 @@ void qxl_release_unmap(struct qxl_device *qdev,
|
|||
struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
|
||||
void *ptr;
|
||||
|
||||
ptr = ((void *)info) - (release->release_offset & ~PAGE_SIZE);
|
||||
ptr = ((void *)info) - (release->release_offset & ~PAGE_MASK);
|
||||
qxl_bo_kunmap_atomic_page(qdev, bo, ptr);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue