There is nothing preventing user of shmem_sg_alloc_table() from passing max_segment smaller than PAGE_SIZE, which would result in nr_pages = max_segment / PAGE_SIZE == 0 and cause a non-terminating loop.
Suggested-by: Janusz Krzysztofik <[email protected]> Assisted-by: GitHub Copilot:claude-opus-5 Signed-off-by: Krzysztof Karas <[email protected]> --- v6: * split max_segment validation out into a new patch; * ran final checks with Claude Opus and added a tag. drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c index bf9e7480f0f5..4b5ce9a2f74f 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c @@ -85,6 +85,9 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st, if (size > resource_size(&mr->region)) return -ENOMEM; + if (max_segment < PAGE_SIZE) + return -EINVAL; + if (sg_alloc_table(st, page_count, GFP_KERNEL | __GFP_NOWARN)) return -ENOMEM; -- 2.34.1
