Patch "drm/amdgpu: Fix off-by-one errors in amdgpu_vm_bo_map" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

drm/amdgpu: Fix off-by-one errors in amdgpu_vm_bo_map

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
drm-amdgpu-fix-off-by-one-errors-in-amdgpu_vm_bo_map.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Felix Kuehling <[email protected]>
Date: Mon, 23 Nov 2015 17:43:48 -0500
Subject: drm/amdgpu: Fix off-by-one errors in amdgpu_vm_bo_map
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Felix Kuehling <[email protected]>

commit 005ae95e6ec119c64e2d16eb65a94c49e1dcf9f0 upstream.

eaddr is sometimes treated as the last address inside the address range, and sometimes as the first address outside the range. This was resulting in errors when a test filled up the entire address space. Make it consistent to always be the last address within the range.

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

@@ -1010,13 +1010,13 @@ int amdgpu_vm_bo_map(struct amdgpu_devic
 		return -EINVAL;
 
 	/* make sure object fit at this offset */
-	eaddr = saddr + size;
+	eaddr = saddr + size - 1;
 	if ((saddr >= eaddr) || (offset + size > amdgpu_bo_size(bo_va->bo)))
 		return -EINVAL;
 
 	last_pfn = eaddr / AMDGPU_GPU_PAGE_SIZE;
-	if (last_pfn > adev->vm_manager.max_pfn) {
-		dev_err(adev->dev, "va above limit (0x%08X > 0x%08X)\n",
+	if (last_pfn >= adev->vm_manager.max_pfn) {
+		dev_err(adev->dev, "va above limit (0x%08X >= 0x%08X)\n",
 			last_pfn, adev->vm_manager.max_pfn);
 		return -EINVAL;
 	}

@@ -1025,7 +1025,7 @@ int amdgpu_vm_bo_map(struct amdgpu_devic
 	eaddr /= AMDGPU_GPU_PAGE_SIZE;
 
 	spin_lock(&vm->it_lock);
-	it = interval_tree_iter_first(&vm->va, saddr, eaddr - 1);
+	it = interval_tree_iter_first(&vm->va, saddr, eaddr);
 	spin_unlock(&vm->it_lock);
 	if (it) {
 		struct amdgpu_bo_va_mapping *tmp;

@@ -1046,7 +1046,7 @@ int amdgpu_vm_bo_map(struct amdgpu_devic
 
 	INIT_LIST_HEAD(&mapping->list);
 	mapping->it.start = saddr;
-	mapping->it.last = eaddr - 1;
+	mapping->it.last = eaddr;
 	mapping->offset = offset;
 	mapping->flags = flags;
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/drm-amdgpu-fix-off-by-one-errors-in-amdgpu_vm_bo_map.patch