There is nothing preventing user of shmem_sg_alloc_table() from passing max_segment smaller than PAGE_SIZE, which would result in nr_pages = max_segment / PAGE_SIZE == 0 and cause a non-terminating loop.
Suggested-by: Janusz Krzysztofik <[email protected]> Suggested-by: Andi Shyti <[email protected]> Signed-off-by: Krzysztof Karas <[email protected]> Reviewed-by: Andi Shyti <[email protected]> --- drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c index bf9e7480f0f5..e35ee4bd456f 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c @@ -85,6 +85,9 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st, if (size > resource_size(&mr->region)) return -ENOMEM; + if (max_segment < PAGE_SIZE || !PAGE_ALIGNED(max_segment)) + return -EINVAL; + if (sg_alloc_table(st, page_count, GFP_KERNEL | __GFP_NOWARN)) return -ENOMEM; -- 2.34.1
