diff options
| author | Jordan Crouse <jcrouse@codeaurora.org> | 2017-02-13 10:14:32 -0700 |
|---|---|---|
| committer | Jordan Crouse <jcrouse@codeaurora.org> | 2017-02-22 09:52:31 -0700 |
| commit | 4b508ebeb81e6908d8c2eb359e90329f661ecdac (patch) | |
| tree | 940e701afee322bc312e8655bbbdfdbce6b41b72 /drivers/gpu | |
| parent | 20e281de4868145daafdf6e0da9b1924a869e152 (diff) | |
drm/msm: Fix the check for the command size
The overrun check for the size of submitted commands is off by one.
It should allow the offset plus the size to be equal to the
size of the memory object when the command stream is very tightly
constructed.
Change-Id: Ic0dedbadec41fb8be84d7522b4dc923dbd537ce5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/msm/msm_gem_submit.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index c04c3c8e0eca..0566cefaae81 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -412,8 +412,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, goto out; } - if ((submit_cmd.size + submit_cmd.submit_offset) >= - msm_obj->base.size) { + if (!(submit_cmd.size) || + ((submit_cmd.size + submit_cmd.submit_offset) > + msm_obj->base.size)) { DRM_ERROR("invalid cmdstream size: %u\n", submit_cmd.size); ret = -EINVAL; goto out; |