]> git.baikalelectronics.ru Git - kernel.git/commit
drm/i915/gvt: fix off-by-one comparison of ring_id
authorColin Ian King <colin.king@canonical.com>
Mon, 4 Dec 2017 17:21:06 +0000 (17:21 +0000)
committerZhenyu Wang <zhenyuw@linux.intel.com>
Tue, 5 Dec 2017 03:45:06 +0000 (11:45 +0800)
commita2bac7f258b6ed8b5e5ef7e97751865949c359e1
tree99f658fc76da1f6404dbdc9a529ccf11bd7a0906
parente71f6e92dc9a7d3d7f70dff251b98de133aaf249
drm/i915/gvt: fix off-by-one comparison of ring_id

The ring_id maximum boundary is being compared using the > operator
instead of >=, leading to an off-by-one error and an out of bounds
write into array vgpu->hws_pga[].  Fix this by simply using the
correct comparison operator. Also re-work another comparison that
uses the comparison > I915_NUM_ENGINES - 1 to use the >= idiom using
to keep this consistent in this code.

Detected by CoverityScan, CID#1462404 ("Out-of-bounds write")

Fixes: 4c05667b66fc ("drm/i915/gvt: update CSB and CSB write pointer in virtual HWSP")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
drivers/gpu/drm/i915/gvt/handlers.c