lkml.org 
[lkml]   [2011]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[75/89] drm/radeon/kms: do bounds checking for 3D_LOAD_VBPNTR and
    2.6.39-stable review patch.  If anyone has any objections, please let us know.

    ------------------
    bump array limit

    From: =?UTF-8?q?Marek=20Ol=C5=A1=C3=A1k?= <maraeo@gmail.com>

    commit a27bb4b209dd6c327fa4e7185f2487f9508a58db upstream.

    To my knowledge, the limit is 16 on r300.
    (the docs don't say what the limit is)

    The lack of bounds checking can be abused to do all sorts of things
    (from bypassing parts of the CS checker to crashing the kernel).

    Bugzilla:
    https://bugs.freedesktop.org/show_bug.cgi?id=36745

    Signed-off-by: Marek Olšák <maraeo@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/gpu/drm/radeon/r100_track.h | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/drivers/gpu/drm/radeon/r100_track.h
    +++ b/drivers/gpu/drm/radeon/r100_track.h
    @@ -63,7 +63,7 @@ struct r100_cs_track {
    unsigned num_arrays;
    unsigned max_indx;
    unsigned color_channel_mask;
    - struct r100_cs_track_array arrays[11];
    + struct r100_cs_track_array arrays[16];
    struct r100_cs_track_cb cb[R300_MAX_CB];
    struct r100_cs_track_cb zb;
    struct r100_cs_track_cb aa;
    @@ -146,6 +146,12 @@ static inline int r100_packet3_load_vbpn
    ib = p->ib->ptr;
    track = (struct r100_cs_track *)p->track;
    c = radeon_get_ib_value(p, idx++) & 0x1F;
    + if (c > 16) {
    + DRM_ERROR("Only 16 vertex buffers are allowed %d\n",
    + pkt->opcode);
    + r100_cs_dump_packet(p, pkt);
    + return -EINVAL;
    + }
    track->num_arrays = c;
    for (i = 0; i < (c - 1); i+=2, idx+=3) {
    r = r100_cs_packet_next_reloc(p, &reloc);

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2011-06-16 09:33    [W:0.022 / U:90.952 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site