From 9e1300a17346bdef3c4edabf1cb8135e52ffeb33 Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Tue, 15 Nov 2011 09:51:15 +0300 Subject: [PATCH] drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow commit 7dcd2499deab8f10011713c40bc2f309c9b65077 upstream ... and do the same for pread. Signed-off-by: Chris Wilson Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/i915_gem.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index e5de66ccffd..27a3074f216 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -482,12 +482,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data, return -EBADF; obj_priv = obj->driver_private; - /* Bounds check source. - * - * XXX: This could use review for overflow issues... - */ - if (args->offset > obj->size || args->size > obj->size || - args->offset + args->size > obj->size) { + /* Bounds check source. */ + if (args->offset > obj->size || args->size > obj->size - args->offset) { ret = -EINVAL; goto err; } @@ -960,12 +956,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, return -EBADF; obj_priv = obj->driver_private; - /* Bounds check destination. - * - * XXX: This could use review for overflow issues... - */ - if (args->offset > obj->size || args->size > obj->size || - args->offset + args->size > obj->size) { + /* Bounds check destination. */ + if (args->offset > obj->size || args->size > obj->size - args->offset) { ret = -EINVAL; goto err; } -- 2.11.4.GIT