korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2025-01-12 08:45:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

drm/imagination: Fixed infinite loop in pvr_vm_mips_map()

Browse Source 
Unwinding loop in error path for this function uses unsigned limit
variable, causing the promotion of the signed counter variable.

--> 204         for (; pfn >= start_pfn; pfn--)
                       ^^^^^^^^^^^^^^^^
If start_pfn can be zero then this is an endless loop.  I've seen this
code in other places as well.  This loop is slightly off as well.  It
should decrement pfn on the first iteration.

Fix by making the loop limit variables signed. Also fix missing
predecrement by modifying to while loop.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Donald Robson <donald.robson@imgtec.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231208160825.92933-1-donald.robson@imgtec.com
This commit is contained in:
Donald Robson 2023-12-08 16:08:25 +00:00 committed by Maxime Ripard
parent b1a2aa9bcb
commit b39610c773
No known key found for this signature in database
GPG Key ID: E3EF0D6F671851C5
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/gpu/drm/imagination/pvr_vm_mips.c
View File

@ -152,8 +152,8 @@ pvr_vm_mips_map(struct pvr_device *pvr_dev, struct pvr_fw_object *fw_obj)
u64 end;
u32 cache_policy;
u32 pte_flags;
u32 start_pfn;
u32 end_pfn;
s32 start_pfn;
s32 end_pfn;
s32 pfn;
int err;
@ -201,7 +201,7 @@ pvr_vm_mips_map(struct pvr_device *pvr_dev, struct pvr_fw_object *fw_obj)
return 0;
err_unmap_pages:
for (; pfn >= start_pfn; pfn--)
while (--pfn >= start_pfn)
WRITE_ONCE(mips_data->pt[pfn], 0);
pvr_mmu_flush_request_all(pvr_dev);