From: Noralf Trønnes <noralf@tronnes.org>
Date: Wed, 21 Nov 2018 18:02:15 +0000 (+0100)
Subject: drm/prime: Fix drm_gem_prime_mmap() stack use
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=10fdb7d2ad4244c668f33706f98d019795fc63c8;p=openwrt%2Fstaging%2Fblogic.git

drm/prime: Fix drm_gem_prime_mmap() stack use

drivers/gpu/drm/drm_prime.c: In function 'drm_gem_prime_mmap':
>> drivers/gpu/drm/drm_prime.c:688:1: warning: the frame size of 1592 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Fix by allocating on the heap.

Fixes: 7698799f9554 ("drm/prime: Add drm_gem_prime_mmap()")
Reported-by: kbuild test robot <lkp@intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181121180215.13881-1-noralf@tronnes.org
---

diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
index 5737cb8c6f03..231e3f6d5f41 100644
--- a/drivers/gpu/drm/drm_prime.c
+++ b/drivers/gpu/drm/drm_prime.c
@@ -663,24 +663,33 @@ EXPORT_SYMBOL(drm_gem_prime_handle_to_fd);
  */
 int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma)
 {
-	/* Used by drm_gem_mmap() to lookup the GEM object */
-	struct drm_file priv = {
-		.minor = obj->dev->primary,
-	};
-	struct file fil = {
-		.private_data = &priv,
-	};
+	struct drm_file *priv;
+	struct file *fil;
 	int ret;
 
-	ret = drm_vma_node_allow(&obj->vma_node, &priv);
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	fil = kzalloc(sizeof(*fil), GFP_KERNEL);
+	if (!priv || !fil) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	/* Used by drm_gem_mmap() to lookup the GEM object */
+	priv->minor = obj->dev->primary;
+	fil->private_data = priv;
+
+	ret = drm_vma_node_allow(&obj->vma_node, priv);
 	if (ret)
-		return ret;
+		goto out;
 
 	vma->vm_pgoff += drm_vma_node_start(&obj->vma_node);
 
-	ret = obj->dev->driver->fops->mmap(&fil, vma);
+	ret = obj->dev->driver->fops->mmap(fil, vma);
 
-	drm_vma_node_revoke(&obj->vma_node, &priv);
+	drm_vma_node_revoke(&obj->vma_node, priv);
+out:
+	kfree(priv);
+	kfree(fil);
 
 	return ret;
 }