1 files changed, 7 insertions, 1 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 907386630e26..4192066ff60e 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1512,7 +1512,7 @@ execbuf_submit(struct i915_execbuffer_params *params,
                      params->args_batch_start_offset;
 
         if (exec_len == 0)
-                exec_len = params->batch->size;
+                exec_len = params->batch->size - params->args_batch_start_offset;
 
         ret = params->engine->emit_bb_start(params->request,
                                             exec_start, exec_len,
@@ -1738,6 +1738,12 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 ret = -EINVAL;
                 goto err;
         }
+        if (args->batch_start_offset > params->batch->size ||
+            args->batch_len > params->batch->size - args->batch_start_offset) {
+                DRM_DEBUG("Attempting to use out-of-bounds batch\n");
+                ret = -EINVAL;
+                goto err;
+        }
 
         params->args_batch_start_offset = args->batch_start_offset;
         if (intel_engine_needs_cmd_parser(engine) && args->batch_len) {