Fix possible overflow in range check, and disallow passing BOs table to GEM_SUBMIT for VM_BIND contexts.
v3: - Also disallow range==0 - Add patch to clear stale nr_ops in lookup_ops error path - Link to v2: https://lore.kernel.org/all/[email protected]/ v2: - Also check that range/obj_offset are not greater than SIZE_MAX. It doesn't matter currently, but would if an armv7 system ever added support for per-process pgtables and VM_BIND. - Add patch to fix handle-dereference in idr_find() error path - Link to v1: https://lore.kernel.org/all/[email protected]/ Rob Clark (4): drm/msm/gem: Fix VM_BIND range check drm/msm/gem: Disallow nr_bos for VM_BIND contexts drm/msm/gem: Decrement loop idx if handle lookup fails drm/msm/gem: Clear nr_ops in lookup_ops() failure path drivers/gpu/drm/msm/msm_gem_submit.c | 5 ++++- drivers/gpu/drm/msm/msm_gem_vma.c | 11 +++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) -- 2.56.0
