From 84fa8e952ead0cc2c5e8a5f41854d49a7aaeeabc Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Wed, 27 Oct 2010 17:37:08 +0100
Subject: [PATCH] --- yaml --- r: 228655 b: refs/heads/master c:
 da761a6edf5c12ba2e7566c5e6bc98899d46ff12 h: refs/heads/master i:   228653:
 49396e6f1a43c30ae91d0dfbaa109fe290dfb018   228651:
 ca51f37d5c958d7ffefd76e06fa8b1e06ed3791c   228647:
 7345afc771a1bdfeb46c70201e34afe3a6cd9867   228639:
 77f99f02c9547ebd5ef08c16876146db11734f17 v: v3

---
 [refs]                                |  2 +-
 trunk/drivers/gpu/drm/i915/i915_gem.c | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 8a18470b444f..b100f0a5910c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: fb7d516af11837126eb1e4a44ab0653bf9b57702
+refs/heads/master: da761a6edf5c12ba2e7566c5e6bc98899d46ff12
diff --git a/trunk/drivers/gpu/drm/i915/i915_gem.c b/trunk/drivers/gpu/drm/i915/i915_gem.c
index 2eceb24bf54b..19ceb8cd0922 100644
--- a/trunk/drivers/gpu/drm/i915/i915_gem.c
+++ b/trunk/drivers/gpu/drm/i915/i915_gem.c
@@ -1258,6 +1258,7 @@ int
 i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 		   struct drm_file *file_priv)
 {
+	struct drm_i915_private *dev_priv = dev->dev_private;
 	struct drm_i915_gem_mmap *args = data;
 	struct drm_gem_object *obj;
 	loff_t offset;
@@ -1270,6 +1271,11 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
 	if (obj == NULL)
 		return -ENOENT;
 
+	if (obj->size > dev_priv->mm.gtt_mappable_end) {
+		drm_gem_object_unreference_unlocked(obj);
+		return -E2BIG;
+	}
+
 	offset = args->offset;
 
 	down_write(&current->mm->mmap_sem);
@@ -1547,6 +1553,7 @@ int
 i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 			struct drm_file *file_priv)
 {
+	struct drm_i915_private *dev_priv = dev->dev_private;
 	struct drm_i915_gem_mmap_gtt *args = data;
 	struct drm_gem_object *obj;
 	struct drm_i915_gem_object *obj_priv;
@@ -1566,6 +1573,11 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 	}
 	obj_priv = to_intel_bo(obj);
 
+	if (obj->size > dev_priv->mm.gtt_mappable_end) {
+		ret = -E2BIG;
+		goto unlock;
+	}
+
 	if (obj_priv->madv != I915_MADV_WILLNEED) {
 		DRM_ERROR("Attempting to mmap a purgeable buffer\n");
 		ret = -EINVAL;