drm/i915: Defend against userspace creating a gem object with size==0
authorChris Wilson <chris@chris-wilson.co.uk>
Wed, 14 Sep 2011 12:14:28 +0000 (14:14 +0200)
committerKeith Packard <keithp@keithp.com>
Thu, 20 Oct 2011 21:11:19 +0000 (14:11 -0700)
We currently only round up the userspace size to the next page. We
assume that userspace hasn't made a mistake and requested a zero-length
gem object and all through our internal code we then presume that every
object is backed by at least a single page. Fix that oversight and
report EINVAL back to userspace if they try to create a zero length
object.

[danvet: This fixes tests/gem_bad_length]

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
drivers/gpu/drm/i915/i915_gem.c

index d8e0c15c874f4fbbbdc1cec977eb1aa13b00c234..52b199da7d5daadc09c5d54bed76ce9b318160f0 100644 (file)
@@ -195,6 +195,8 @@ i915_gem_create(struct drm_file *file,
        u32 handle;
 
        size = roundup(size, PAGE_SIZE);
+       if (size == 0)
+               return -EINVAL;
 
        /* Allocate the new object */
        obj = i915_gem_alloc_object(dev, size);