| Message ID | 20180620130358.26247-1-mperttunen@nvidia.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | drm/tegra: Fix comparison operator for buffer size | expand |
On Wednesday, 20 June 2018 16:03:58 MSK Mikko Perttunen wrote: > Here we are checking for the buffer length, not an offset for writing > to, so using > is correct. The current code incorrectly rejects a > command buffer ending at the memory buffer's end. > > Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> > --- > drivers/gpu/drm/tegra/drm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c > index 776c1513e582..a2bd5876c633 100644 > --- a/drivers/gpu/drm/tegra/drm.c > +++ b/drivers/gpu/drm/tegra/drm.c > @@ -398,7 +398,7 @@ int tegra_drm_submit(struct tegra_drm_context *context, > * unaligned offset is malformed and cause commands stream > * corruption on the buffer address relocation. > */ > - if (offset & 3 || offset >= obj->gem.size) { > + if (offset & 3 || offset > obj->gem.size) { > err = -EINVAL; > goto fail; > } Reviewed-by: Dmitry Osipenko <digetx@gmail.com> -- To unsubscribe from this list: send the line "unsubscribe linux-tegra" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Jun 20, 2018 at 04:03:58PM +0300, Mikko Perttunen wrote: > Here we are checking for the buffer length, not an offset for writing > to, so using > is correct. The current code incorrectly rejects a > command buffer ending at the memory buffer's end. > > Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> > --- > drivers/gpu/drm/tegra/drm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Applied, thanks. Thierry
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c index 776c1513e582..a2bd5876c633 100644 --- a/drivers/gpu/drm/tegra/drm.c +++ b/drivers/gpu/drm/tegra/drm.c @@ -398,7 +398,7 @@ int tegra_drm_submit(struct tegra_drm_context *context, * unaligned offset is malformed and cause commands stream * corruption on the buffer address relocation. */ - if (offset & 3 || offset >= obj->gem.size) { + if (offset & 3 || offset > obj->gem.size) { err = -EINVAL; goto fail; }
Here we are checking for the buffer length, not an offset for writing to, so using > is correct. The current code incorrectly rejects a command buffer ending at the memory buffer's end. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> --- drivers/gpu/drm/tegra/drm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)