From: Umesh Nerlige Ramappa Date: Wed, 20 Sep 2023 19:29:21 +0000 (-0400) Subject: drm/xe: Fix array bounds check for queries X-Git-Tag: v6.8-rc1~111^2~7^2~282 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fd47ded2379265b58dd5ae699fa1f5a14e65fdfc;p=thirdparty%2Flinux.git drm/xe: Fix array bounds check for queries Queries are 0-indexed, so a query with value N is invalid if the ARRAY_SIZE is N. Modify the check to account for that. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Niranjana Vishwanathapura Signed-off-by: Francois Dugast Signed-off-by: Rodrigo Vivi --- diff --git a/drivers/gpu/drm/xe/xe_query.c b/drivers/gpu/drm/xe/xe_query.c index a951205100fea..e0c2203e428e1 100644 --- a/drivers/gpu/drm/xe/xe_query.c +++ b/drivers/gpu/drm/xe/xe_query.c @@ -381,7 +381,7 @@ int xe_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file) XE_IOCTL_DBG(xe, query->reserved[0] || query->reserved[1])) return -EINVAL; - if (XE_IOCTL_DBG(xe, query->query > ARRAY_SIZE(xe_query_funcs))) + if (XE_IOCTL_DBG(xe, query->query >= ARRAY_SIZE(xe_query_funcs))) return -EINVAL; idx = array_index_nospec(query->query, ARRAY_SIZE(xe_query_funcs));