diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2011-11-15 09:51:15 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-11-26 09:10:35 -0800 |
| commit | 9e1300a17346bdef3c4edabf1cb8135e52ffeb33 (patch) | |
| tree | 77b26ce7b8d7b96ab209a1609c470f99123235ea /drivers | |
| parent | 4609e74a3eead6f129eb470ed5e3d09b2a2978d0 (diff) | |
| download | lwn-9e1300a17346bdef3c4edabf1cb8135e52ffeb33.tar.gz lwn-9e1300a17346bdef3c4edabf1cb8135e52ffeb33.zip | |
drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow
commit 7dcd2499deab8f10011713c40bc2f309c9b65077 upstream
... and do the same for pread.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem.c | 16 |
1 files changed, 4 insertions, 12 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index e5de66ccffda..27a3074f216c 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -482,12 +482,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, return -EBADF; obj_priv = obj->driver_private; - /* Bounds check source. - * - * XXX: This could use review for overflow issues... - */ - if (args->offset > obj->size || args->size > obj->size || - args->offset + args->size > obj->size) { + /* Bounds check source. */ + if (args->offset > obj->size || args->size > obj->size - args->offset) { ret = -EINVAL; goto err; } @@ -960,12 +956,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, return -EBADF; obj_priv = obj->driver_private; - /* Bounds check destination. - * - * XXX: This could use review for overflow issues... - */ - if (args->offset > obj->size || args->size > obj->size || - args->offset + args->size > obj->size) { + /* Bounds check destination. */ + if (args->offset > obj->size || args->size > obj->size - args->offset) { ret = -EINVAL; goto err; } |