mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 23:27:06 +00:00
drm/i810: Prevent underflow in ioctl
commit 4f69851fba
upstream.
The "used" variables here come from the user in the ioctl and it can be
negative. It could result in an out of bounds write.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
8e47f51af8
commit
9a0511abab
1 changed files with 2 additions and 2 deletions
|
@ -721,7 +721,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev,
|
|||
if (nbox > I810_NR_SAREA_CLIPRECTS)
|
||||
nbox = I810_NR_SAREA_CLIPRECTS;
|
||||
|
||||
if (used > 4 * 1024)
|
||||
if (used < 0 || used > 4 * 1024)
|
||||
used = 0;
|
||||
|
||||
if (sarea_priv->dirty)
|
||||
|
@ -1041,7 +1041,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in
|
|||
if (u != I810_BUF_CLIENT)
|
||||
DRM_DEBUG("MC found buffer that isn't mine!\n");
|
||||
|
||||
if (used > 4 * 1024)
|
||||
if (used < 0 || used > 4 * 1024)
|
||||
used = 0;
|
||||
|
||||
sarea_priv->dirty = 0x7f;
|
||||
|
|
Loading…
Reference in a new issue