git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ab21e60) | patch
drm/radeon/kms: do bounds checking for 3D_LOAD_VBPNTR and bump array limit
authorMarek Olšák <maraeo@gmail.com>
Fri, 10 Jun 2011 14:41:26 +0000 (14:41 +0000)
committerDave Airlie <airlied@redhat.com>
Tue, 14 Jun 2011 00:59:03 +0000 (10:59 +1000)
commita27bb4b209dd6c327fa4e7185f2487f9508a58db
tree2c4ff2f2ded3beaaa74ef16047d5ab405e30d906tree | snapshot
parentab21e60beaa96f2c55604f633dfe74076c531df7commit | diff
drm/radeon/kms: do bounds checking for 3D_LOAD_VBPNTR and bump array limit

To my knowledge, the limit is 16 on r300.
(the docs don't say what the limit is)

The lack of bounds checking can be abused to do all sorts of things
(from bypassing parts of the CS checker to crashing the kernel).

Bugzilla:
https://bugs.freedesktop.org/show_bug.cgi?id=36745

Cc: stable@kernel.org
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/radeon/r100_track.h diff | blob | history
Pandora Kernel Repository