Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7f073d01 authored by Dan Carpenter's avatar Dan Carpenter Committed by Ben Skeggs
Browse files

drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() 



The bo array has req->nr_buffers elements so the > should be >= so we
don't read beyond the end of the array.

Fixes: a1606a95 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent df0c97e2

drivers/gpu/drm/nouveau/nouveau_gem.c

+2 −2
Original line number Diff line number Diff line
@@ -616,7 +616,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, 
		struct nouveau_bo *nvbo;

		uint32_t data;



		if (unlikely(r->bo_index > req->nr_buffers)) {

		if (unlikely(r->bo_index >= req->nr_buffers)) {

			NV_PRINTK(err, cli, "reloc bo index invalid\n");

			ret = -EINVAL;

			break;
@@ -626,7 +626,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli, 
		if (b->presumed.valid)

			continue;



		if (unlikely(r->reloc_bo_index > req->nr_buffers)) {

		if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {

			NV_PRINTK(err, cli, "reloc container bo index invalid\n");

			ret = -EINVAL;

			break;