• Colin Ian King's avatar
    drm/i915/gvt: fix off-by-one comparison of ring_id · 8e60b7f1
    Colin Ian King authored
    The ring_id maximum boundary is being compared using the > operator
    instead of >=, leading to an off-by-one error and an out of bounds
    write into array vgpu->hws_pga[].  Fix this by simply using the
    correct comparison operator. Also re-work another comparison that
    uses the comparison > I915_NUM_ENGINES - 1 to use the >= idiom using
    to keep this consistent in this code.
    
    Detected by CoverityScan, CID#1462404 ("Out-of-bounds write")
    
    Fixes: a2ae95af ("drm/i915/gvt: update CSB and CSB write pointer in virtual HWSP")
    Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
    Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
    8e60b7f1
handlers.c 94.9 KB