drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
[ Upstream commitpull/10/head7f073d011f
] The bo array has req->nr_buffers elements so the > should be >= so we don't read beyond the end of the array. Fixes:a1606a9596
("drm/nouveau: new gem pushbuf interface, bump to 0.0.16") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
b6fadd93ad
commit
dcedabcab0
|
@ -599,7 +599,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
|
|||
struct nouveau_bo *nvbo;
|
||||
uint32_t data;
|
||||
|
||||
if (unlikely(r->bo_index > req->nr_buffers)) {
|
||||
if (unlikely(r->bo_index >= req->nr_buffers)) {
|
||||
NV_PRINTK(err, cli, "reloc bo index invalid\n");
|
||||
ret = -EINVAL;
|
||||
break;
|
||||
|
@ -609,7 +609,7 @@ nouveau_gem_pushbuf_reloc_apply(struct nouveau_cli *cli,
|
|||
if (b->presumed.valid)
|
||||
continue;
|
||||
|
||||
if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
|
||||
if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
|
||||
NV_PRINTK(err, cli, "reloc container bo index invalid\n");
|
||||
ret = -EINVAL;
|
||||
break;
|
||||
|
|
Loading…
Reference in New Issue