drm/i915: Update the restrict check to filter out wrong Ring ID passed by user-space

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Reviewed-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

2 files changed, 2 insertions, 1 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index b9dcc2869edc..0aa1b4cb1f6d 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1037,7 +1037,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
         if (args->flags & I915_EXEC_IS_PINNED)
                 flags |= I915_DISPATCH_PINNED;
 
-        if ((args->flags & I915_EXEC_RING_MASK) > I915_NUM_RINGS) {
+        if ((args->flags & I915_EXEC_RING_MASK) > LAST_USER_RING) {
                 DRM_DEBUG("execbuf with unknown ring: %d\n",
                           (int)(args->flags & I915_EXEC_RING_MASK));
                 return -EINVAL;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 54839165eb6d..7c0eb33d5027 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -63,6 +63,7 @@ struct  intel_ring_buffer {
                 VECS,
         } id;
 #define I915_NUM_RINGS 4
+#define LAST_USER_RING (VECS + 1)
         u32             mmio_base;
         void            __iomem *virtual_start;
         struct          drm_device *dev;