Fix possible overflow in range check, and disallow passing BOs table to GEM_SUBMIT for VM_BIND contexts.
v2: - Also check that range/obj_offset are not greater than SIZE_MAX. It doesn't matter currently, but would if an armv7 system ever added support for per-process pgtables and VM_BIND. - Add patch to fix handle-dereference in idr_find() error path - Link to v1: https://lore.kernel.org/all/[email protected]/ Rob Clark (3): drm/msm/gem: Fix VM_BIND range check drm/msm/gem: Disallow nr_bos for VM_BIND contexts drm/msm/gem: Decrement loop idx if handle lookup fails drivers/gpu/drm/msm/msm_gem_submit.c | 5 ++++- drivers/gpu/drm/msm/msm_gem_vma.c | 7 ++++--- 2 files changed, 8 insertions(+), 4 deletions(-) -- 2.56.0
