projects
/
platform
/
kernel
/
linux-rpi3.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
4dd3cdb
)
drm/savage: off by one in savage_bci_cmdbuf()
author
Dan Carpenter
<dan.carpenter@oracle.com>
Wed, 4 Jul 2018 09:48:10 +0000
(12:48 +0300)
committer
Daniel Vetter
<daniel.vetter@ffwll.ch>
Wed, 4 Jul 2018 12:27:01 +0000
(14:27 +0200)
The > should be >= here so that we don't read beyond the end of the
dma->buflist[] array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link:
https://patchwork.freedesktop.org/patch/msgid/20180704094810.whrgn6jxe7uibnfv@kili.mountain
drivers/gpu/drm/savage/savage_state.c
patch
|
blob
|
history
diff --git
a/drivers/gpu/drm/savage/savage_state.c
b/drivers/gpu/drm/savage/savage_state.c
index
2db89be
..
7559a82
100644
(file)
--- a/
drivers/gpu/drm/savage/savage_state.c
+++ b/
drivers/gpu/drm/savage/savage_state.c
@@
-971,7
+971,7
@@
int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
LOCK_TEST_WITH_RETURN(dev, file_priv);
if (dma && dma->buflist) {
- if (cmdbuf->dma_idx > dma->buf_count) {
+ if (cmdbuf->dma_idx >
=
dma->buf_count) {
DRM_ERROR
("vertex buffer index %u out of range (0-%u)\n",
cmdbuf->dma_idx, dma->buf_count - 1);