tree 0b11d6c7a0a9b15ac8ad2a46352e250f1d5e395d
parent 13f3fbe827d09e3182023c8c54058cbf97aa146e
author Bob Paauwe <bob.j.paauwe@intel.com> 1418925086 -0800
committer Jani Nikula <jani.nikula@intel.com> 1422262833 +0200

drm/i915: Only fence tiled region of object.

When creating a fence for a tiled object, only fence the area that
makes up the actual tiles.  The object may be larger than the tiled
area and if we allow those extra addresses to be fenced, they'll
get converted to addresses beyond where the object is mapped. This
opens up the possiblity of writes beyond the end of object.

To prevent this, we adjust the size of the fence to only encompass
the area that makes up the actual tiles.  The extra space is considered
un-tiled and now behaves as if it was a linear object.

Testcase: igt/gem_tiled_fence_overflow
Reported-by: Dan Hettena <danh@ghs.com>
Signed-off-by: Bob Paauwe <bob.j.paauwe@intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: stable@vger.kernel.org
Signed-off-by: Jani Nikula <jani.nikula@intel.com>