diff options
author | Michel Dänzer <michel.daenzer@amd.com> | 2012-04-26 12:10:02 +0200 |
---|---|---|
committer | Michel Dänzer <michel@daenzer.net> | 2012-08-16 11:58:23 +0200 |
commit | 1f455ef5bc3c9711d9452dcc09fd849656ad8b33 (patch) | |
tree | 9dd0c2875c954ebfb1e2f5dd470f0d328e9d166b | |
parent | 6d59b7f6dc3131e773e9c9729388c08a2f987364 (diff) |
gallium/radeon: Fix potential address space loss in radeon_bomgr_force_va().
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
-rw-r--r-- | src/gallium/winsys/radeon/drm/radeon_drm_bo.c | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c index 1bf22a71d91..79355af7995 100644 --- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c +++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c @@ -268,18 +268,25 @@ static void radeon_bomgr_force_va(struct radeon_bomgr *mgr, uint64_t va, uint64_ mgr->va_offset = va + size; } else { struct radeon_bo_va_hole *hole, *n; - uint64_t stmp, etmp; + uint64_t hole_end, va_end; - /* free all holes that fall into the range - * NOTE that we might lose virtual address space + /* Prune/free all holes that fall into the range */ LIST_FOR_EACH_ENTRY_SAFE(hole, n, &mgr->va_holes, list) { - stmp = hole->offset; - etmp = stmp + hole->size; - if (va >= stmp && va < etmp) { + hole_end = hole->offset + hole->size; + va_end = va + size; + if (hole->offset >= va_end || hole_end <= va) + continue; + if (hole->offset >= va && hole_end <= va_end) { list_del(&hole->list); FREE(hole); + continue; } + if (hole->offset >= va) + hole->offset = va_end; + else + hole_end = va; + hole->size = hole_end - hole->offset; } } pipe_mutex_unlock(mgr->bo_va_mutex); |