Skip to contentSkip to conversation

drm/radeon: fix underflow in r600_cp_dispatch_texture()

PATCH Applied Dan Carpenter 3 participants 3 messages Jul 3, 2015 – Jul 6, 2015

Subsystems (3)
DRM drivers Kernel janitors Radeon and amdgpu DRM drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 drm/radeon: fix underflow in r600_cp_dispatch_texture()

The "if (pass_size > buf->total)" can underflow so I have changed the type of size and pass_size to unsigned to avoid this problem.

Signed-off-by Dan Carpenter <[email protected]>

---
This code is on the way out, but whatever. I may as well send this patch since I already wrote the patch.

drivers/gpu/drm/radeon/r600_cp.c +1 -1
index 09e3f39..98f9ada 100644
@@ -2483,7 +2483,7 @@ int r600_cp_dispatch_texture(struct drm_device *dev,
 	struct drm_buf *buf;
 	u32 *buffer;
 	const u8 __user *data;
-	int size, pass_size;
+	unsigned int size, pass_size;
 	u64 src_offset, dst_offset;
 
 	if (!radeon_check_offset(dev_priv, tex->offset)) {
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 4 lines · Dan Carpenter

The "if (pass_size > buf->total)" can underflow so I have changed the type of size and pass_size to unsigned to avoid this problem.

Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Christian König <[email protected]>
Quoted 3 lines

---
This code is on the way out, but whatever. I may as well send this patch since I already wrote the patch.

Yeah, indeed but it will still take a while until we can really remove it.

Well, maybe it's time to give it a try.

Regards,
Christian.

Quoted 6 lines
drivers/gpu/drm/radeon/r600_cp.c +0 -0
index 09e3f39..98f9ada 100644

drivers/gpu/drm/radeon/r600_cp.c int r600_cp_dispatch_texture(struct drm_device *dev, · line 2489

Quoted 8 lines
drivers/gpu/drm/radeon/r600_cp.c +1 -1
@@ -2483,7 +2483,7 @@ int r600_cp_dispatch_texture(struct drm_device *dev,
  	struct drm_buf *buf;
  	u32 *buffer;
  	const u8 __user *data;
-	int size, pass_size;
+	unsigned int size, pass_size;
  	u64 src_offset, dst_offset;
 
  	if (!radeon_check_offset(dev_priv, tex->offset)) {

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Applied
#2 lore raw
Quoted 9 lines · Christian König
Quoted 5 lines · Dan Carpenter

The "if (pass_size > buf->total)" can underflow so I have changed the type of size and pass_size to unsigned to avoid this problem.

Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Christian König <[email protected]>

Applied. thanks.

Quoted 9 lines
Quoted 4 lines

---
This code is on the way out, but whatever. I may as well send this patch since I already wrote the patch.

Yeah, indeed but it will still take a while until we can really remove it.

Well, maybe it's time to give it a try.

I think it's probably about time. IIRC, intel already dropped UMS support.

Alex

Quoted 25 lines

Regards,
Christian.

Quoted 7 lines
drivers/gpu/drm/radeon/r600_cp.c +0 -0
index 09e3f39..98f9ada 100644

drivers/gpu/drm/radeon/r600_cp.c int r600_cp_dispatch_texture(struct drm_device *dev, · line 2488

Quoted 7 lines
drivers/gpu/drm/radeon/r600_cp.c +1 -1
@@ -2483,7 +2483,7 @@ int r600_cp_dispatch_texture(struct drm_device *dev,
        struct drm_buf *buf;
        u32 *buffer;
        const u8 __user *data;
-       int size, pass_size;
+       unsigned int size, pass_size;
        u64 src_offset, dst_offset;
        if (!radeon_check_offset(dev_priv, tex->offset)) {

_______________________________________________
dri-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/dri-devel