diff options
| author | Alex Deucher <alexander.deucher@amd.com> | 2013-01-30 14:24:09 -0500 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2013-02-20 03:15:23 +0000 |
| commit | b819a9646971e6f0bfad33a67459b23677cd5d1c (patch) | |
| tree | 27a5b6dcc0f7b27e8da0244612a216d046e4bebf /drivers/gpu/drm/radeon | |
| parent | e7a2a2e32bba0121dc1e4c2006fab092f30b4e0f (diff) | |
drm/radeon: prevent crash in the ring space allocation
commit fd5d93a0015ce1a7db881382022b2fcdfdc61760 upstream.
If the requested number of DWs on the ring is larger than
the size of the ring itself, return an error.
In testing with large VM updates, we've seen crashes when we
try and allocate more space on the ring than the total size
of the ring without checking.
This prevents the crash but for large VM updates or bo moves
of very large buffers, we will need to break the transaction
down into multiple batches. I have patches to use IBs for
the next kernel.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2: use rdev->cp.ring_size instead of ring->ring_size]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/gpu/drm/radeon')
| -rw-r--r-- | drivers/gpu/drm/radeon/radeon_ring.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c index 49d58202202c..65be5e8aaee2 100644 --- a/drivers/gpu/drm/radeon/radeon_ring.c +++ b/drivers/gpu/drm/radeon/radeon_ring.c @@ -306,6 +306,9 @@ int radeon_ring_alloc(struct radeon_device *rdev, unsigned ndw) { int r; + /* make sure we aren't trying to allocate more space than there is on the ring */ + if (ndw > (rdev->cp.ring_size / 4)) + return -ENOMEM; /* Align requested size with padding so unlock_commit can * pad safely */ ndw = (ndw + rdev->cp.align_mask) & ~rdev->cp.align_mask; |