From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 23 Dec 2014 09:56:49 +0000 (+0300)
Subject: drm/radeon: integer underflow in radeon_cp_dispatch_texture()
X-Git-Tag: omap-for-v4.1/prcm-dts-mfd-syscon-fix~306^2~1^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dd5a74f2f982193620cfa1ef609df1ee805781d4;p=pandora-kernel.git

drm/radeon: integer underflow in radeon_cp_dispatch_texture()

The test:

	if (size > RADEON_MAX_TEXTURE_SIZE) {

"size" is an integer and it's controled by the user so it can be
negative and the test can underflow.  Later we use "size" in:

	dwords = size / 4;
	...
	RADEON_COPY_MT(buffer, data, (int)(dwords * sizeof(u32)));

It causes memory corruption to copy a negative size buffer.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---

Reading git-diff-tree failed