提交 5265f033 编写于 作者: M Mikko Perttunen 提交者: Thierry Reding

drm/tegra: Fix comparison operator for buffer size

Here we are checking for the buffer length, not an offset for writing
to, so using > is correct. The current code incorrectly rejects a
command buffer ending at the memory buffer's end.
Signed-off-by: NMikko Perttunen <mperttunen@nvidia.com>
Reviewed-by: NDmitry Osipenko <digetx@gmail.com>
Signed-off-by: NThierry Reding <treding@nvidia.com>
上级 ec589232
...@@ -398,7 +398,7 @@ int tegra_drm_submit(struct tegra_drm_context *context, ...@@ -398,7 +398,7 @@ int tegra_drm_submit(struct tegra_drm_context *context,
* unaligned offset is malformed and cause commands stream * unaligned offset is malformed and cause commands stream
* corruption on the buffer address relocation. * corruption on the buffer address relocation.
*/ */
if (offset & 3 || offset >= obj->gem.size) { if (offset & 3 || offset > obj->gem.size) {
err = -EINVAL; err = -EINVAL;
goto fail; goto fail;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册