Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a0511ab authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

drm/i810: Prevent underflow in ioctl 



commit 4f69851fbaa26b155330be35ce8ac393e93e7442 upstream.

The "used" variables here come from the user in the ioctl and it can be
negative.  It could result in an out of bounds write.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda


Cc: stable@vger.kernel.org
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8e47f51a

drivers/gpu/drm/i810/i810_dma.c

+2 −2
Original line number Diff line number Diff line
@@ -721,7 +721,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev, 
	if (nbox > I810_NR_SAREA_CLIPRECTS)

		nbox = I810_NR_SAREA_CLIPRECTS;



	if (used > 4 * 1024)

	if (used < 0 || used > 4 * 1024)

		used = 0;



	if (sarea_priv->dirty)
@@ -1041,7 +1041,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in 
	if (u != I810_BUF_CLIENT)

		DRM_DEBUG("MC found buffer that isn't mine!\n");



	if (used > 4 * 1024)

	if (used < 0 || used > 4 * 1024)

		used = 0;



	sarea_priv->dirty = 0x7f;