Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a1de8d0a authored by Dan Carpenter's avatar Dan Carpenter Committed by Daniel Vetter
Browse files

drm/i810: off by one in i810_dma_vertex() 



If vertex->idx == dma->buf_count then we end up reading one element
beyond the end of the dma->buflist[] array.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180703123015.kma7v7rwtdy4urce@kili.mountain
parent 64e625cf

drivers/gpu/drm/i810/i810_dma.c

+1 −1
Original line number Diff line number Diff line
@@ -934,7 +934,7 @@ static int i810_dma_vertex(struct drm_device *dev, void *data, 
	DRM_DEBUG("idx %d used %d discard %d\n",

		  vertex->idx, vertex->used, vertex->discard);



	if (vertex->idx < 0 || vertex->idx > dma->buf_count)

	if (vertex->idx < 0 || vertex->idx >= dma->buf_count)

		return -EINVAL;



	i810_dma_dispatch_vertex(dev,