From: Dan Carpenter Date: Thu, 13 Apr 2017 19:48:28 +0000 (+0300) Subject: drm/i915/gvt: fix a bounds check in ring_id_to_context_switch_event() X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c821ee6d2bb4cfc9991bf285f53103cde9d3593a;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git drm/i915/gvt: fix a bounds check in ring_id_to_context_switch_event() There are two bugs here. The && should be || and the > is off by one so it should be >= ARRAY_SIZE(). Fixes: 8453d674ae7e ("drm/i915/gvt: vGPU execlist virtualization") Signed-off-by: Dan Carpenter Signed-off-by: Zhenyu Wang --- diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c index d077ed97970f..dc9aef3e92d4 100644 --- a/drivers/gpu/drm/i915/gvt/execlist.c +++ b/drivers/gpu/drm/i915/gvt/execlist.c @@ -56,8 +56,8 @@ static int context_switch_events[] = { static int ring_id_to_context_switch_event(int ring_id) { - if (WARN_ON(ring_id < RCS && ring_id > - ARRAY_SIZE(context_switch_events))) + if (WARN_ON(ring_id < RCS || + ring_id >= ARRAY_SIZE(context_switch_events))) return -EINVAL; return context_switch_events[ring_id];