Merge tag 'drm-misc-fixes-2018-12-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes (b6aac625) · Commits · 戴 / test

drivers/gpu/drm/drm_ioctl.c

+8 −2

Original line number	Original line	Diff line number	Diff line
	@@ -37,6 +37,7 @@

	#include <linux/pci.h>		#include <linux/pci.h>
	#include <linux/export.h>		#include <linux/export.h>
			#include <linux/nospec.h>

	/**		/**
	* DOC: getunique and setversion story		* DOC: getunique and setversion story
	@@ -800,13 +801,17 @@ long drm_ioctl(struct file *filp,

	if (is_driver_ioctl) {		if (is_driver_ioctl) {
	/* driver ioctl */		/* driver ioctl */
	if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)		unsigned int index = nr - DRM_COMMAND_BASE;

			if (index >= dev->driver->num_ioctls)
	goto err_i1;		goto err_i1;
	ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];		index = array_index_nospec(index, dev->driver->num_ioctls);
			ioctl = &dev->driver->ioctls[index];
	} else {		} else {
	/* core ioctl */		/* core ioctl */
	if (nr >= DRM_CORE_IOCTL_COUNT)		if (nr >= DRM_CORE_IOCTL_COUNT)
	goto err_i1;		goto err_i1;
			nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
	ioctl = &drm_ioctls[nr];		ioctl = &drm_ioctls[nr];
	}		}

	@@ -888,6 +893,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)

	if (nr >= DRM_CORE_IOCTL_COUNT)		if (nr >= DRM_CORE_IOCTL_COUNT)
	return false;		return false;
			nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);

	*flags = drm_ioctls[nr].flags;		*flags = drm_ioctls[nr].flags;
	return true;		return true;