redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

drm/vgem: off by one in vgem_gem_fault() 

If page_offset is == num_pages then we end up reading beyond the end of
obj->pages[].

Fixes: af33a9190d ("drm/vgem: Enable dmabuf import interfaces")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180703122921.brlfxl4vx2ybvrd2@kili.mountain
hifive-unleashed-5.1
Dan Carpenter 2018-07-03 15:29:21 +03:00 committed by Daniel Vetter
parent a1de8d0a7e
commit de10eba0f6
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/vgem/vgem_drv.c
View File

@ -74,7 +74,7 @@ static vm_fault_t vgem_gem_fault(struct vm_fault *vmf)
num_pages = DIV_ROUND_UP(obj->base.size, PAGE_SIZE);
if (page_offset > num_pages)
if (page_offset >= num_pages)
return VM_FAULT_SIGBUS;
mutex_lock(&obj->pages_lock);