drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow
... and do the same for pread. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@kernel.orghifive-unleashed-5.1
parent
ce9d419dbe
commit
7dcd2499de
|
@ -471,12 +471,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
|
||||||
return -ENOENT;
|
return -ENOENT;
|
||||||
obj_priv = to_intel_bo(obj);
|
obj_priv = to_intel_bo(obj);
|
||||||
|
|
||||||
/* Bounds check source.
|
/* Bounds check source. */
|
||||||
*
|
if (args->offset > obj->size || args->size > obj->size - args->offset) {
|
||||||
* XXX: This could use review for overflow issues...
|
|
||||||
*/
|
|
||||||
if (args->offset > obj->size || args->size > obj->size ||
|
|
||||||
args->offset + args->size > obj->size) {
|
|
||||||
ret = -EINVAL;
|
ret = -EINVAL;
|
||||||
goto err;
|
goto err;
|
||||||
}
|
}
|
||||||
|
@ -939,12 +935,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
|
||||||
return -ENOENT;
|
return -ENOENT;
|
||||||
obj_priv = to_intel_bo(obj);
|
obj_priv = to_intel_bo(obj);
|
||||||
|
|
||||||
/* Bounds check destination.
|
/* Bounds check destination. */
|
||||||
*
|
if (args->offset > obj->size || args->size > obj->size - args->offset) {
|
||||||
* XXX: This could use review for overflow issues...
|
|
||||||
*/
|
|
||||||
if (args->offset > obj->size || args->size > obj->size ||
|
|
||||||
args->offset + args->size > obj->size) {
|
|
||||||
ret = -EINVAL;
|
ret = -EINVAL;
|
||||||
goto err;
|
goto err;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue