Merge tag 'drm-amdkfd-next-fixes-2015-06-16' of git://people.freedesktop.org/~gabbayo/linux into drm-next

- Dan fixed some range checks in the address watch ioctl impl.
- Remove obsolete member from radeon_device structure

* tag 'drm-amdkfd-next-fixes-2015-06-16' of git://people.freedesktop.org/~gabbayo/linux:
  drm/amdkfd: fix some range checks in address watch ioctl
  drm/radeon: remove obsolete kfd_bo from radeon_device

2 files changed, 3 insertions, 4 deletions

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 96c904b3acb7..c991973019d0 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -553,7 +553,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
         /* Validate arguments */
 
         if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) ||
-                (args->buf_size_in_bytes <= sizeof(*args)) ||
+                (args->buf_size_in_bytes <= sizeof(*args) + sizeof(int) * 2) ||
                 (cmd_from_user == NULL))
                 return -EINVAL;
 
@@ -590,7 +590,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
         /* skip over the addresses buffer */
         args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points;
 
-        if (args_idx >= args->buf_size_in_bytes) {
+        if (args_idx >= args->buf_size_in_bytes - sizeof(*args)) {
                 kfree(args_buff);
                 return -EINVAL;
         }
@@ -614,7 +614,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
                 args_idx += sizeof(aw_info.watch_mask);
         }
 
-        if (args_idx > args->buf_size_in_bytes) {
+        if (args_idx >= args->buf_size_in_bytes - sizeof(args)) {
                 kfree(args_buff);
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 4d2d0579fd49..f03b7eb15233 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -2458,7 +2458,6 @@ struct radeon_device {
 
         /* amdkfd interface */
         struct kfd_dev          *kfd;
-        struct radeon_sa_manager        kfd_bo;
 
         struct mutex    mn_lock;
         DECLARE_HASHTABLE(mn_hash, 7);