drm/i810: Prevent underflow in ioctl
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 4 Oct 2019 10:22:51 +0000 (13:22 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 21 Dec 2019 09:41:37 +0000 (10:41 +0100)
commit6f7582ab7856e863300c8ad6c4e73f0884480918
tree16c5ace5a31000c848c4a7d35cae7c27d4534034
parentcbf58157fb5a319f28d859cc072d3091d593e507
drm/i810: Prevent underflow in ioctl

commit 4f69851fbaa26b155330be35ce8ac393e93e7442 upstream.

The "used" variables here come from the user in the ioctl and it can be
negative.  It could result in an out of bounds write.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/i810/i810_dma.c