From 1f455ef5bc3c9711d9452dcc09fd849656ad8b33 Mon Sep 17 00:00:00 2001 From: Michel Dänzer Date: Thu, 26 Apr 2012 12:10:02 +0200 Subject: gallium/radeon: Fix potential address space loss in radeon_bomgr_force_va(). MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Michel Dänzer Reviewed-by: Alex Deucher --- src/gallium/winsys/radeon/drm/radeon_drm_bo.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) (limited to 'src/gallium/winsys') diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c index 1bf22a71d91..79355af7995 100644 --- a/src/gallium/winsys/radeon/drm/radeon_drm_bo.c +++ b/src/gallium/winsys/radeon/drm/radeon_drm_bo.c @@ -268,18 +268,25 @@ static void radeon_bomgr_force_va(struct radeon_bomgr *mgr, uint64_t va, uint64_ mgr->va_offset = va + size; } else { struct radeon_bo_va_hole *hole, *n; - uint64_t stmp, etmp; + uint64_t hole_end, va_end; - /* free all holes that fall into the range - * NOTE that we might lose virtual address space + /* Prune/free all holes that fall into the range */ LIST_FOR_EACH_ENTRY_SAFE(hole, n, &mgr->va_holes, list) { - stmp = hole->offset; - etmp = stmp + hole->size; - if (va >= stmp && va < etmp) { + hole_end = hole->offset + hole->size; + va_end = va + size; + if (hole->offset >= va_end || hole_end <= va) + continue; + if (hole->offset >= va && hole_end <= va_end) { list_del(&hole->list); FREE(hole); + continue; } + if (hole->offset >= va) + hole->offset = va_end; + else + hole_end = va; + hole->size = hole_end - hole->offset; } } pipe_mutex_unlock(mgr->bo_va_mutex); -- cgit v1.2.3