Module Name: src
Committed By: riastradh
Date: Sun Dec 19 12:29:47 UTC 2021
Modified Files:
src/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem:
nouveau_nvkm_subdev_instmem_gk20a.c
src/sys/external/bsd/drm2/dist/drm/via: via_dmablit.c
Log Message:
drm: Avoid potential integer overflow in pages->bytes conversion.
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 \
src/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c
cvs rdiff -u -r1.9 -r1.10 \
src/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c
diff -u src/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c:1.8 src/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c:1.9
--- src/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c:1.8 Sun Dec 19 11:34:45 2021
+++ src/sys/external/bsd/drm2/dist/drm/nouveau/nvkm/subdev/instmem/nouveau_nvkm_subdev_instmem_gk20a.c Sun Dec 19 12:29:47 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.8 2021/12/19 11:34:45 riastradh Exp $ */
+/* $NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.9 2021/12/19 12:29:47 riastradh Exp $ */
/*
* Copyright (c) 2015, NVIDIA CORPORATION. All rights reserved.
@@ -44,7 +44,7 @@
* goes beyond a certain threshold. At the moment this limit is 1MB.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.8 2021/12/19 11:34:45 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nouveau_nvkm_subdev_instmem_gk20a.c,v 1.9 2021/12/19 12:29:47 riastradh Exp $");
#include "priv.h"
@@ -507,24 +507,25 @@ gk20a_instobj_ctor_iommu(struct gk20a_in
node->base.memory.ptrs = &gk20a_instobj_ptrs;
#ifdef __NetBSD__
+ bus_size_t nbytes = (bus_size_t)npages << PAGE_SHIFT;
__USE(i);
__USE(r);
__USE(dev);
/* XXX errno NetBSD->Linux */
- ret = -bus_dmamem_alloc(imem->dmat, npages << PAGE_SHIFT, PAGE_SIZE,
+ ret = -bus_dmamem_alloc(imem->dmat, nbytes, PAGE_SIZE,
PAGE_SIZE, node->segs, npages, &node->nsegs, BUS_DMA_WAITOK);
if (ret)
fail0: goto out;
/* XXX errno NetBSD->Linux */
- ret = -bus_dmamap_create(imem->dmat, npages << PAGE_SHIFT, 1,
- npages << PAGE_SHIFT, PAGE_SIZE, BUS_DMA_WAITOK, &node->map);
+ ret = -bus_dmamap_create(imem->dmat, nbytes, 1, nbytes, PAGE_SIZE,
+ BUS_DMA_WAITOK, &node->map);
if (ret) {
fail1: bus_dmamem_free(imem->dmat, node->segs, node->nsegs);
goto fail0;
}
/* XXX errno NetBSD->Linux */
ret = -bus_dmamap_load_raw(imem->dmat, node->map, node->segs,
- node->nsegs, npages << PAGE_SHIFT, BUS_DMA_WAITOK);
+ node->nsegs, nbytes, BUS_DMA_WAITOK);
if (ret) {
fail2: __unused
bus_dmamap_destroy(imem->dmat, node->map);
Index: src/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c
diff -u src/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c:1.9 src/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c:1.10
--- src/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c:1.9 Sat Dec 18 23:45:44 2021
+++ src/sys/external/bsd/drm2/dist/drm/via/via_dmablit.c Sun Dec 19 12:29:47 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: via_dmablit.c,v 1.9 2021/12/18 23:45:44 riastradh Exp $ */
+/* $NetBSD: via_dmablit.c,v 1.10 2021/12/19 12:29:47 riastradh Exp $ */
/* via_dmablit.c -- PCI DMA BitBlt support for the VIA Unichrome/Pro
*
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: via_dmablit.c,v 1.9 2021/12/18 23:45:44 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: via_dmablit.c,v 1.10 2021/12/19 12:29:47 riastradh Exp $");
#include <linux/pagemap.h>
#include <linux/pci.h>
@@ -212,7 +212,7 @@ via_free_sg_info(struct drm_device *dev,
bus_dmamap_unload(dev->dmat, vsg->desc_dmamap);
bus_dmamap_destroy(dev->dmat, vsg->desc_dmamap);
bus_dmamem_unmap(dev->dmat, vsg->desc_kva,
- vsg->num_desc_pages << PAGE_SHIFT);
+ (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT);
bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
kfree(vsg->desc_segs);
#else
@@ -360,7 +360,8 @@ via_alloc_desc_pages(struct drm_device *
return -ENOMEM;
}
/* XXX errno NetBSD->Linux */
- ret = -bus_dmamem_alloc(dev->dmat, vsg->num_desc_pages << PAGE_SHIFT,
+ ret = -bus_dmamem_alloc(dev->dmat,
+ (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT,
PAGE_SIZE, 0, vsg->desc_segs, vsg->num_pages, &vsg->num_desc_segs,
BUS_DMA_WAITOK);
if (ret) {
@@ -371,7 +372,8 @@ via_alloc_desc_pages(struct drm_device *
/* XXX No nice way to scatter/gather map bus_dmamem. */
/* XXX errno NetBSD->Linux */
ret = -bus_dmamem_map(dev->dmat, vsg->desc_segs, vsg->num_desc_segs,
- vsg->num_desc_pages << PAGE_SHIFT, &vsg->desc_kva, BUS_DMA_WAITOK);
+ (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT, &vsg->desc_kva,
+ BUS_DMA_WAITOK);
if (ret) {
bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
kfree(vsg->desc_segs);
@@ -379,23 +381,25 @@ via_alloc_desc_pages(struct drm_device *
return -ENOMEM;
}
/* XXX errno NetBSD->Linux */
- ret = -bus_dmamap_create(dev->dmat, vsg->num_desc_pages << PAGE_SHIFT,
+ ret = -bus_dmamap_create(dev->dmat,
+ (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT,
vsg->num_desc_pages, PAGE_SIZE, 0, BUS_DMA_WAITOK,
&vsg->desc_dmamap);
if (ret) {
bus_dmamem_unmap(dev->dmat, vsg->desc_kva,
- vsg->num_desc_pages << PAGE_SHIFT);
+ (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT);
bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
kfree(vsg->desc_segs);
kfree(vsg->desc_pages);
return -ENOMEM;
}
ret = -bus_dmamap_load(dev->dmat, vsg->desc_dmamap, vsg->desc_kva,
- vsg->num_desc_pages << PAGE_SHIFT, NULL, BUS_DMA_WAITOK);
+ (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT, NULL,
+ BUS_DMA_WAITOK);
if (ret) {
bus_dmamap_destroy(dev->dmat, vsg->desc_dmamap);
bus_dmamem_unmap(dev->dmat, vsg->desc_kva,
- vsg->num_desc_pages << PAGE_SHIFT);
+ (bus_size_t)vsg->num_desc_pages << PAGE_SHIFT);
bus_dmamem_free(dev->dmat, vsg->desc_segs, vsg->num_desc_segs);
kfree(vsg->desc_segs);
kfree(vsg->desc_pages);
