drm: Fix a bug in the range manager.

When searching for free space in a range, the function could return a node extending outside of the given range.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index cdec32977129b98bf00179f01e919dc297fcf333..2ac074c8f5d2e546d40ff53fa3fe54c83547773d 100644 (file)
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -405,7 +405,8 @@ struct drm_mm_node *drm_mm_search_free_in_range(const struct drm_mm *mm,
                                wasted += alignment - tmp;
                }
 
-               if (entry->size >= size + wasted) {
+               if (entry->size >= size + wasted &&
+                   (entry->start + wasted + size) <= end) {
                        if (!best_match)
                                return entry;
                        if (entry->size < best_size) {