Merge tag 'drm-intel-fixes-2021-12-15' of ssh://git.freedesktop.org/git/drm/drm-intel into drm-fixes

airlied · airlied · commit c9f0322c4692 · 2021-12-16T10:22:34.000+10:00
Fix a bound check in the DMC fw load. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/YbnGvnsX/H3rKAqO@intel.com
diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c b/drivers/gpu/drm/i915/display/intel_dmc.c
@@ -596,7 +596,7 @@ static void parse_dmc_fw(struct drm_i915_private *dev_priv,
 			continue;
 
 		offset = readcount + dmc->dmc_info[id].dmc_offset * 4;
-		if (fw->size - offset < 0) {
+		if (offset > fw->size) {
 			drm_err(&dev_priv->drm, "Reading beyond the fw_size\n");
 			continue;
 		}

Original file line number	Diff line number	Diff line change
`@@ -596,7 +596,7 @@ static void parse_dmc_fw(struct drm_i915_private *dev_priv,`
`596`	`596`	`continue;`
`597`	`597`
`598`	`598`	`offset = readcount + dmc->dmc_info[id].dmc_offset * 4;`
`599`		`- if (fw->size - offset < 0) {`
	`599`	`+ if (offset > fw->size) {`
`600`	`600`	`drm_err(&dev_priv->drm, "Reading beyond the fw_size\n");`
`601`	`601`	`continue;`
`602`	`602`	`}`