diff options
Diffstat (limited to 'drivers/gpu/drm/vc4/vc4_gem.c')
-rw-r--r-- | drivers/gpu/drm/vc4/vc4_gem.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c index db920771bfb5..ab3016982466 100644 --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4/vc4_gem.c | |||
@@ -594,12 +594,14 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec) | |||
594 | args->shader_rec_count); | 594 | args->shader_rec_count); |
595 | struct vc4_bo *bo; | 595 | struct vc4_bo *bo; |
596 | 596 | ||
597 | if (uniforms_offset < shader_rec_offset || | 597 | if (shader_rec_offset < args->bin_cl_size || |
598 | uniforms_offset < shader_rec_offset || | ||
598 | exec_size < uniforms_offset || | 599 | exec_size < uniforms_offset || |
599 | args->shader_rec_count >= (UINT_MAX / | 600 | args->shader_rec_count >= (UINT_MAX / |
600 | sizeof(struct vc4_shader_state)) || | 601 | sizeof(struct vc4_shader_state)) || |
601 | temp_size < exec_size) { | 602 | temp_size < exec_size) { |
602 | DRM_ERROR("overflow in exec arguments\n"); | 603 | DRM_ERROR("overflow in exec arguments\n"); |
604 | ret = -EINVAL; | ||
603 | goto fail; | 605 | goto fail; |
604 | } | 606 | } |
605 | 607 | ||