Merge "soc: qcom: hgsl: Fix OOB" (b57c0b42) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/soc/qcom/hgsl/hgsl.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -681,7 +681,7 @@ static int hgsl_dbq_assign(struct file *filep, unsigned long arg)
		if (copy_from_user(&dbq_idx, USRPTR(arg), sizeof(dbq_idx)))
		return -EFAULT;

		if (dbq_idx > MAX_DB_QUEUE)
		if (dbq_idx >= MAX_DB_QUEUE)
		return -EINVAL;

		priv->dbq_idx = dbq_idx;
		@@ -1340,6 +1340,9 @@ static int hgsl_ioctl_hsync_fence_create(struct file *filep,

		copy_from_user(&param, USRPTR(arg), sizeof(param));

		if (param.context_id >= HGSL_CONTEXT_NUM)
		return -EINVAL;

		read_lock(&hgsl->ctxt_lock);
		ctxt = hgsl->contexts[param.context_id];
		read_unlock(&hgsl->ctxt_lock);