drm/i810: Prevent underflow in ioctl

The "used" variables here come from the user in the ioctl and it can be
negative.  It could result in an out of bounds write.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 2a77823b8e9a210973f2516b40c584537ad1c520..e66c38332df473422e39b7b9fb5a846d28380ca5 100644 (file)
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -728,7 +728,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev,
        if (nbox > I810_NR_SAREA_CLIPRECTS)
                nbox = I810_NR_SAREA_CLIPRECTS;
 
-       if (used > 4 * 1024)
+       if (used < 0 || used > 4 * 1024)
                used = 0;
 
        if (sarea_priv->dirty)
@@ -1048,7 +1048,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in
        if (u != I810_BUF_CLIENT)
                DRM_DEBUG("MC found buffer that isn't mine!\n");
 
-       if (used > 4 * 1024)
+       if (used < 0 || used > 4 * 1024)
                used = 0;
 
        sarea_priv->dirty = 0x7f;