drm/i915/gvt: fix off-by-one comparison of ring_id
authorColin Ian King <colin.king@canonical.com>
Mon, 4 Dec 2017 17:21:06 +0000 (17:21 +0000)
committerZhenyu Wang <zhenyuw@linux.intel.com>
Tue, 5 Dec 2017 03:45:06 +0000 (11:45 +0800)
commit8e60b7f195d2536b2f090ae97f74ed19a504d60c
tree99f658fc76da1f6404dbdc9a529ccf11bd7a0906
parentf745e9cc7e40c4570ab5e8d5ef32bfaa6e8ced46
drm/i915/gvt: fix off-by-one comparison of ring_id

The ring_id maximum boundary is being compared using the > operator
instead of >=, leading to an off-by-one error and an out of bounds
write into array vgpu->hws_pga[].  Fix this by simply using the
correct comparison operator. Also re-work another comparison that
uses the comparison > I915_NUM_ENGINES - 1 to use the >= idiom using
to keep this consistent in this code.

Detected by CoverityScan, CID#1462404 ("Out-of-bounds write")

Fixes: a2ae95af9646 ("drm/i915/gvt: update CSB and CSB write pointer in virtual HWSP")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
drivers/gpu/drm/i915/gvt/handlers.c