Commit de10eba0 authored by Dan Carpenter's avatar Dan Carpenter Committed by Daniel Vetter

drm/vgem: off by one in vgem_gem_fault()

If page_offset is == num_pages then we end up reading beyond the end of
obj->pages[].

Fixes: af33a919 ("drm/vgem: Enable dmabuf import interfaces")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180703122921.brlfxl4vx2ybvrd2@kili.mountain
parent a1de8d0a
...@@ -74,7 +74,7 @@ static vm_fault_t vgem_gem_fault(struct vm_fault *vmf) ...@@ -74,7 +74,7 @@ static vm_fault_t vgem_gem_fault(struct vm_fault *vmf)
num_pages = DIV_ROUND_UP(obj->base.size, PAGE_SIZE); num_pages = DIV_ROUND_UP(obj->base.size, PAGE_SIZE);
if (page_offset > num_pages) if (page_offset >= num_pages)
return VM_FAULT_SIGBUS; return VM_FAULT_SIGBUS;
mutex_lock(&obj->pages_lock); mutex_lock(&obj->pages_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment