diff options
| author | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2019-03-28 14:32:06 +0100 |
|---|---|---|
| committer | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2019-03-28 14:32:06 +0100 |
| commit | 32aca03c2ce868d3412da0bb6ce6798c7bea357e (patch) | |
| tree | 01630dc4a6935df99bf7d11d34ff8d384fed86e2 /drivers/gpu/drm/drm_bufs.c | |
| parent | cfbbc7703fff59c67761c93a8b1de29a79f9841c (diff) | |
| parent | 60771fc402877163d07569addadcf18b86acb455 (diff) | |
Merge tag 'v4.9.166' into 4.9-2.3.x-imx
This is the 4.9.166 stable release
Diffstat (limited to 'drivers/gpu/drm/drm_bufs.c')
| -rw-r--r-- | drivers/gpu/drm/drm_bufs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c index 3ff9495b28d6..fb02fb0579de 100644 --- a/drivers/gpu/drm/drm_bufs.c +++ b/drivers/gpu/drm/drm_bufs.c @@ -36,6 +36,8 @@ #include <drm/drmP.h> #include "drm_legacy.h" +#include <linux/nospec.h> + static struct drm_map_list *drm_find_matching_map(struct drm_device *dev, struct drm_local_map *map) { @@ -1413,6 +1415,7 @@ int drm_legacy_freebufs(struct drm_device *dev, void *data, idx, dma->buf_count - 1); return -EINVAL; } + idx = array_index_nospec(idx, dma->buf_count); buf = dma->buflist[idx]; if (buf->file_priv != file_priv) { DRM_ERROR("Process %d freeing buffer not owned\n", |