drm/i810: Prevent underflow in ioctl

BugLink: https://bugs.launchpad.net/bugs/1856334
commit 4f69851fbaa26b155330be35ce8ac393e93e7442 upstream.

The "used" variables here come from the user in the ioctl and it can be
negative.  It could result in an out of bounds write.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 3b378936f57559fbfe80a30a6b14ee00aa9f7136..a9b15001416a729bca83439647cdd52ecf2b9965 100644 (file)
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -721,7 +721,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev,
        if (nbox > I810_NR_SAREA_CLIPRECTS)
                nbox = I810_NR_SAREA_CLIPRECTS;
 
-       if (used > 4 * 1024)
+       if (used < 0 || used > 4 * 1024)
                used = 0;
 
        if (sarea_priv->dirty)
@@ -1041,7 +1041,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in
        if (u != I810_BUF_CLIENT)
                DRM_DEBUG("MC found buffer that isn't mine!\n");
 
-       if (used > 4 * 1024)
+       if (used < 0 || used > 4 * 1024)
                used = 0;
 
        sarea_priv->dirty = 0x7f;