From cf46e6660b39afaceeabf83ef2819c7bfabe1d26 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Tue, 15 Sep 2009 23:23:18 +0100
Subject: [PATCH] --- yaml --- r: 166023 b: refs/heads/master c:
 cd0b9fb400ba775737bdc3874c4cbee4047e66d8 h: refs/heads/master i:   166021:
 af18f1d068080850e3fc14db9a07c85b2941d684   166019:
 5da0249e18d8456808ce72a9217320b33e9a6f33   166015:
 e86f36cb0dc34fbe73789c231a99778af08552d7 v: v3

---
 [refs]                                |  2 +-
 trunk/drivers/gpu/drm/i915/i915_gem.c | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index ff7080daf7e4..54c4ac5f494c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: edb81956422c9926553bb97e3e56b849da0f4bb5
+refs/heads/master: cd0b9fb400ba775737bdc3874c4cbee4047e66d8
diff --git a/trunk/drivers/gpu/drm/i915/i915_gem.c b/trunk/drivers/gpu/drm/i915/i915_gem.c
index 725b4484a092..c60ca32f65d2 100644
--- a/trunk/drivers/gpu/drm/i915/i915_gem.c
+++ b/trunk/drivers/gpu/drm/i915/i915_gem.c
@@ -3158,6 +3158,16 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
 			return -EINVAL;
 		}
 
+		if (reloc->delta >= target_obj->size) {
+			DRM_ERROR("Relocation beyond target object bounds: "
+				  "obj %p target %d delta %d size %d.\n",
+				  obj, reloc->target_handle,
+				  (int) reloc->delta, (int) target_obj->size);
+			drm_gem_object_unreference(target_obj);
+			i915_gem_object_unpin(obj);
+			return -EINVAL;
+		}
+
 		if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
 		    reloc->read_domains & I915_GEM_DOMAIN_CPU) {
 			DRM_ERROR("reloc with read/write CPU domains: "