OSDN Git Service

drm/prime: Fix drm_gem_prime_mmap() stack use
authorNoralf Trønnes <noralf@tronnes.org>
Wed, 21 Nov 2018 18:02:15 +0000 (19:02 +0100)
committerNoralf Trønnes <noralf@tronnes.org>
Thu, 22 Nov 2018 14:44:05 +0000 (15:44 +0100)
drivers/gpu/drm/drm_prime.c: In function 'drm_gem_prime_mmap':
>> drivers/gpu/drm/drm_prime.c:688:1: warning: the frame size of 1592 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Fix by allocating on the heap.

Fixes: 7698799f9554 ("drm/prime: Add drm_gem_prime_mmap()")
Reported-by: kbuild test robot <lkp@intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181121180215.13881-1-noralf@tronnes.org
drivers/gpu/drm/drm_prime.c

index 5737cb8..231e3f6 100644 (file)
@@ -663,24 +663,33 @@ EXPORT_SYMBOL(drm_gem_prime_handle_to_fd);
  */
 int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma)
 {
-       /* Used by drm_gem_mmap() to lookup the GEM object */
-       struct drm_file priv = {
-               .minor = obj->dev->primary,
-       };
-       struct file fil = {
-               .private_data = &priv,
-       };
+       struct drm_file *priv;
+       struct file *fil;
        int ret;
 
-       ret = drm_vma_node_allow(&obj->vma_node, &priv);
+       priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+       fil = kzalloc(sizeof(*fil), GFP_KERNEL);
+       if (!priv || !fil) {
+               ret = -ENOMEM;
+               goto out;
+       }
+
+       /* Used by drm_gem_mmap() to lookup the GEM object */
+       priv->minor = obj->dev->primary;
+       fil->private_data = priv;
+
+       ret = drm_vma_node_allow(&obj->vma_node, priv);
        if (ret)
-               return ret;
+               goto out;
 
        vma->vm_pgoff += drm_vma_node_start(&obj->vma_node);
 
-       ret = obj->dev->driver->fops->mmap(&fil, vma);
+       ret = obj->dev->driver->fops->mmap(fil, vma);
 
-       drm_vma_node_revoke(&obj->vma_node, &priv);
+       drm_vma_node_revoke(&obj->vma_node, priv);
+out:
+       kfree(priv);
+       kfree(fil);
 
        return ret;
 }