drm/i810: Prevent underflow in ioctl
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 4 Oct 2019 10:22:51 +0000 (13:22 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 13 Dec 2019 07:42:56 +0000 (08:42 +0100)
commit5d8115f5357514c9fca42f6effdd4d06aefccab2
tree28f4f61865d5c8c222044eba9a237f539bf698ba
parenta77ab316261fd074003d9d6261dc184bb893738f
drm/i810: Prevent underflow in ioctl

commit 4f69851fbaa26b155330be35ce8ac393e93e7442 upstream.

The "used" variables here come from the user in the ioctl and it can be
negative.  It could result in an out of bounds write.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/i810/i810_dma.c