system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-22 12:26:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

drm/i810: off by one in i810_dma_vertex()

Browse source 
If vertex->idx == dma->buf_count then we end up reading one element
beyond the end of the dma->buflist[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180703123015.kma7v7rwtdy4urce@kili.mountain
This commit is contained in:
Dan Carpenter 2018-07-03 15:30:16 +03:00 committed by Daniel Vetter
parent 64e625cf53
commit a1de8d0a7e
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/gpu/drm/i810/i810_dma.c
View file

@ -934,7 +934,7 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
DRM_DEBUG("idx %d used %d discard %d\n", DRM_DEBUG("idx %d used %d discard %d\n",
vertex->idx, vertex->used, vertex->discard); vertex->idx, vertex->used, vertex->discard);
if (vertex->idx < 0 || vertex->idx > dma->buf_count) if (vertex->idx < 0 || vertex->idx >= dma->buf_count)
return -EINVAL; return -EINVAL;
i810_dma_dispatch_vertex(dev, i810_dma_dispatch_vertex(dev,