]> git.baikalelectronics.ru Git - kernel.git/commit
drm/i915/gvt: fix off-by-one comparison of ring_id
authorColin Ian King <colin.king@canonical.com>
Mon, 4 Dec 2017 17:21:06 +0000 (17:21 +0000)
committerZhenyu Wang <zhenyuw@linux.intel.com>
Tue, 5 Dec 2017 03:45:06 +0000 (11:45 +0800)
commitcfa3228b7d3e5e2522250b954585a85388d61459
tree99f658fc76da1f6404dbdc9a529ccf11bd7a0906
parentd091d9f53144b0f1fbca3e5ee0bbfd3e3a08e0cf
drm/i915/gvt: fix off-by-one comparison of ring_id

The ring_id maximum boundary is being compared using the > operator
instead of >=, leading to an off-by-one error and an out of bounds
write into array vgpu->hws_pga[].  Fix this by simply using the
correct comparison operator. Also re-work another comparison that
uses the comparison > I915_NUM_ENGINES - 1 to use the >= idiom using
to keep this consistent in this code.

Detected by CoverityScan, CID#1462404 ("Out-of-bounds write")

Fixes: 8ce1503b6277 ("drm/i915/gvt: update CSB and CSB write pointer in virtual HWSP")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
drivers/gpu/drm/i915/gvt/handlers.c