drm/vgem: off by one in vgem_gem_fault()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 3 Jul 2018 12:29:21 +0000 (15:29 +0300)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Tue, 3 Jul 2018 13:06:15 +0000 (15:06 +0200)
commitde10eba0f68a161f3176b710b6e27d291d48aac2
treef8e74c76821b6ee47c37d7d7da906d762cd57006
parenta1de8d0a7e2cc79dad6d469901b3b5d4c94c4554
drm/vgem: off by one in vgem_gem_fault()

If page_offset is == num_pages then we end up reading beyond the end of
obj->pages[].

Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180703122921.brlfxl4vx2ybvrd2@kili.mountain
drivers/gpu/drm/vgem/vgem_drv.c