Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753833AbdHOBdu (ORCPT ); Mon, 14 Aug 2017 21:33:50 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:57224 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753657AbdHOBUF (ORCPT ); Mon, 14 Aug 2017 21:20:05 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Wladimir J. van der Laan" , Philipp Zabel , Christian Gmeiner , Lucas Stach Subject: [PATCH 4.12 22/65] drm/etnaviv: Fix off-by-one error in reloc checking Date: Mon, 14 Aug 2017 18:19:13 -0700 Message-Id: <20170815011943.277278472@linuxfoundation.org> X-Mailer: git-send-email 2.14.0 In-Reply-To: <20170815011942.395714306@linuxfoundation.org> References: <20170815011942.395714306@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1175 Lines: 35 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wladimir J. van der Laan commit d6f756e09f01ea7a0efbbcef269a1e384a35d824 upstream. A relocation pointing to the last four bytes of a buffer can legitimately happen in the case of small vertex buffers. Signed-off-by: Wladimir J. van der Laan Reviewed-by: Philipp Zabel Reviewed-by: Christian Gmeiner Signed-off-by: Lucas Stach Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c @@ -270,8 +270,8 @@ static int submit_reloc(struct etnaviv_g if (ret) return ret; - if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) { - DRM_ERROR("relocation %u outside object", i); + if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) { + DRM_ERROR("relocation %u outside object\n", i); return -EINVAL; }