Re: [PATCH] drm/i915: Sanity check mmap length against object size

Quoting Chris Wilson (2019-03-14 07:58:29)

We assumed that vm_mmap() would reject an attempt to mmap past the end of the filp (our object), but we were wrong.

Applications that tried to use the mmap beyond the end of the object would be greeted by a SIGBUS.

Reported-by: Antonio Argenziano antonio.argenziano@intel.com Testcase: igt/gem_mmap/bad-size Signed-off-by: Chris Wilson chris@chris-wilson.co.uk Cc: Antonio Argenziano antonio.argenziano@intel.com Cc: Joonas Lahtinen joonas.lahtinen@linux.intel.com Cc: Tvrtko Ursulin tvrtko.ursulin@intel.com Cc: stable@vger.kernel.org