From patchwork Tue Jul 25 12:33:36 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Wladimir J. van der Laan" X-Patchwork-Id: 9861937 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id DCB08600F5 for ; Tue, 25 Jul 2017 12:33:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D0FFC28600 for ; Tue, 25 Jul 2017 12:33:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C51B02866C; Tue, 25 Jul 2017 12:33:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 6D44628600 for ; Tue, 25 Jul 2017 12:33:57 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 800806E43E; Tue, 25 Jul 2017 12:33:56 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wm0-x241.google.com (mail-wm0-x241.google.com [IPv6:2a00:1450:400c:c09::241]) by gabe.freedesktop.org (Postfix) with ESMTPS id C7FB86E43E; Tue, 25 Jul 2017 12:33:55 +0000 (UTC) Received: by mail-wm0-x241.google.com with SMTP id 79so894745wmr.4; Tue, 25 Jul 2017 05:33:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=5of9a4ezAP4MOq1dLBQtX2jscPkJj1igQ1UZ6Tvl3NY=; b=J57oI26Zv4B5nmCP7NKe6laW1/naZdAQhm5GeSw5wKTamuewDYdQBdQId/gI/1LEd0 iRJRzX/yjgU1k7BJgISW9A5oTcw6WyfMG28uuXZgiKBUPqM7MBoWpHFRn53rO/jqYboI av5z2BHVib1DxpgPEJc3menWq8ecf5Wp9y2WttK82s/2zJyUPG8uwBrGqR3xCIq++FmE cF9TrJdvgFSJUSVGKDT/qsrP+yoov70U6b+hF5CkGgBo5FRT4ve3FVjJFMBQcXptWJKj kQjQh5NRoQDlRRbyrPKcRX96d2YxknEhFPtWr5qqOLOQpAy74acBm4oMrE9Aq1vb80L2 2X0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=5of9a4ezAP4MOq1dLBQtX2jscPkJj1igQ1UZ6Tvl3NY=; b=p/o6bofT9H6vME4ixNOQNabUYJDhlth1ByAKZfJfpO1gQ+SPYCEbCiyABX3hW4E1R2 37jkSLQ2S2kAq+dqyZI7U0h2pej8Wc0FEqR4VVA3ArN+9QnIDR+Hd5ulYp86i196vw8T dcFQORovBf1M3d4r77eGBIjwIJnPf7yfSLSp9qpFa5o5NbV/DQFE+JpfsLDKJqx84AsQ 6D9vIodcMGquDHDCZN4Jhkz8Qypncdo25lno+V6gOOiPRDUHVg3kjM3t6nmSJfsckxne fOmNIbWainUbVesB2pjfFEwkrfifElTaqUnH7iJrnbXFP6uHQRuMbcF5ixpqmv4nRhcB mRYA== X-Gm-Message-State: AIVw110IU3tGlEWlFMjDs5r0wKH9eUSPsvNa4xC0ctMZjbVxAuwQC+yZ oH7N69iJSKLhFc0WU8j7iA== X-Received: by 10.28.238.85 with SMTP id m82mr3206586wmh.107.1500986034242; Tue, 25 Jul 2017 05:33:54 -0700 (PDT) Received: from amethyst.lan (e107206.upc-e.chello.nl. [213.93.107.206]) by smtp.gmail.com with ESMTPSA id v190sm9065090wme.2.2017.07.25.05.33.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 25 Jul 2017 05:33:53 -0700 (PDT) From: "Wladimir J. van der Laan" To: dri-devel@lists.freedesktop.org, etnaviv@lists.freedesktop.org Subject: [PATCH] drm/etnaviv: Fix off-by-one error in reloc checking Date: Tue, 25 Jul 2017 14:33:36 +0200 Message-Id: <1500986016-10540-1-git-send-email-laanwj@gmail.com> X-Mailer: git-send-email 2.7.4 Cc: "Wladimir J. van der Laan" , Chris Healy X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP A relocation pointing to the last four bytes of a buffer can legitimately happen in the case of small vertex buffers. Signed-off-by: Wladimir J. van der Laan Reviewed-by: Philipp Zabel Reviewed-by: Christian Gmeiner --- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c index de80ee1..21be4dc 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c @@ -270,8 +270,8 @@ static int submit_reloc(struct etnaviv_gem_submit *submit, void *stream, if (ret) return ret; - if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) { - DRM_ERROR("relocation %u outside object", i); + if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) { + DRM_ERROR("relocation %u outside object\n", i); return -EINVAL; }