diff options
author | Chris Wilson <chris@chris-wilson.co.uk> | 2011-09-14 08:14:28 -0400 |
---|---|---|
committer | Keith Packard <keithp@keithp.com> | 2011-10-20 17:11:19 -0400 |
commit | 8ffc02468145ac92b1b88896e0f18bd7bcd52591 (patch) | |
tree | adb0d1d1343b8ca93dec9bf95a5263455371654a /drivers/gpu/drm/i915/i915_gem.c | |
parent | 6dacfd2faa398dc5206523ae6a2f8dd037488de8 (diff) |
drm/i915: Defend against userspace creating a gem object with size==0
We currently only round up the userspace size to the next page. We
assume that userspace hasn't made a mistake and requested a zero-length
gem object and all through our internal code we then presume that every
object is backed by at least a single page. Fix that oversight and
report EINVAL back to userspace if they try to create a zero length
object.
[danvet: This fixes tests/gem_bad_length]
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem.c')
-rw-r--r-- | drivers/gpu/drm/i915/i915_gem.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index d8e0c15c874f..52b199da7d5d 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c | |||
@@ -195,6 +195,8 @@ i915_gem_create(struct drm_file *file, | |||
195 | u32 handle; | 195 | u32 handle; |
196 | 196 | ||
197 | size = roundup(size, PAGE_SIZE); | 197 | size = roundup(size, PAGE_SIZE); |
198 | if (size == 0) | ||
199 | return -EINVAL; | ||
198 | 200 | ||
199 | /* Allocate the new object */ | 201 | /* Allocate the new object */ |
200 | obj = i915_gem_alloc_object(dev, size); | 202 | obj = i915_gem_alloc_object(dev, size); |