From: hyesoo.yu Date: Fri, 8 Sep 2017 05:29:16 +0000 (+0900) Subject: [COMMON] g2d: fix out-of-bounds read X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=3d96b3ff4faf1e48836b696770543b0f5fef2ebb;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git [COMMON] g2d: fix out-of-bounds read Overrunning array release_fences of 17 4-byte elements at element index 4294967294 (byte offset 17179869176) using index Change-Id: I18d984096c8975fb2afc38a2785baf8e5505ca4d Signed-off-by: hyesoo.yu --- diff --git a/drivers/gpu/exynos/g2d/g2d_fence.c b/drivers/gpu/exynos/g2d/g2d_fence.c index d9f70e7ae79e..5a7138b401b8 100644 --- a/drivers/gpu/exynos/g2d/g2d_fence.c +++ b/drivers/gpu/exynos/g2d/g2d_fence.c @@ -148,7 +148,7 @@ struct sync_file *g2d_create_release_fence(struct g2d_device *g2d_dev, struct dma_fence *fence; struct sync_file *file; s32 release_fences[G2D_MAX_IMAGES + 1]; - unsigned int i; + int i; int ret = 0; if (!(task->flags & G2D_FLAG_NONBLOCK) || !data->num_release_fences)