]> git.baikalelectronics.ru Git - kernel.git/commit
drm/radeon/kms: do bounds checking for 3D_LOAD_VBPNTR and bump array limit
authorMarek Olšák <maraeo@gmail.com>
Fri, 10 Jun 2011 14:41:26 +0000 (14:41 +0000)
committerDave Airlie <airlied@redhat.com>
Tue, 14 Jun 2011 00:59:03 +0000 (10:59 +1000)
commit568823f10d5cdbcc3b7433318d3c3fac1652fd8e
tree2c4ff2f2ded3beaaa74ef16047d5ab405e30d906
parenta626d662aa0b489fcee4adb4e541f57e3d51d34b
drm/radeon/kms: do bounds checking for 3D_LOAD_VBPNTR and bump array limit

To my knowledge, the limit is 16 on r300.
(the docs don't say what the limit is)

The lack of bounds checking can be abused to do all sorts of things
(from bypassing parts of the CS checker to crashing the kernel).

Bugzilla:
https://bugs.freedesktop.org/show_bug.cgi?id=36745

Cc: stable@kernel.org
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/radeon/r100_track.h