Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de10eba0 authored by Dan Carpenter's avatar Dan Carpenter Committed by Daniel Vetter
Browse files

drm/vgem: off by one in vgem_gem_fault() 



If page_offset is == num_pages then we end up reading beyond the end of
obj->pages[].

Fixes: af33a919 ("drm/vgem: Enable dmabuf import interfaces")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180703122921.brlfxl4vx2ybvrd2@kili.mountain
parent a1de8d0a

drivers/gpu/drm/vgem/vgem_drv.c

+1 −1
Original line number Diff line number Diff line
@@ -74,7 +74,7 @@ static vm_fault_t vgem_gem_fault(struct vm_fault *vmf) 


	num_pages = DIV_ROUND_UP(obj->base.size, PAGE_SIZE);



	if (page_offset > num_pages)

	if (page_offset >= num_pages)

		return VM_FAULT_SIGBUS;



	mutex_lock(&obj->pages_lock);