| From 4f69851fbaa26b155330be35ce8ac393e93e7442 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Fri, 4 Oct 2019 13:22:51 +0300 |
| Subject: drm/i810: Prevent underflow in ioctl |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| commit 4f69851fbaa26b155330be35ce8ac393e93e7442 upstream. |
| |
| The "used" variables here come from the user in the ioctl and it can be |
| negative. It could result in an out of bounds write. |
| |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> |
| Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> |
| Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/gpu/drm/i810/i810_dma.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/gpu/drm/i810/i810_dma.c |
| +++ b/drivers/gpu/drm/i810/i810_dma.c |
| @@ -723,7 +723,7 @@ static void i810_dma_dispatch_vertex(str |
| if (nbox > I810_NR_SAREA_CLIPRECTS) |
| nbox = I810_NR_SAREA_CLIPRECTS; |
| |
| - if (used > 4 * 1024) |
| + if (used < 0 || used > 4 * 1024) |
| used = 0; |
| |
| if (sarea_priv->dirty) |
| @@ -1043,7 +1043,7 @@ static void i810_dma_dispatch_mc(struct |
| if (u != I810_BUF_CLIENT) |
| DRM_DEBUG("MC found buffer that isn't mine!\n"); |
| |
| - if (used > 4 * 1024) |
| + if (used < 0 || used > 4 * 1024) |
| used = 0; |
| |
| sarea_priv->dirty = 0x7f; |
