From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Fri, 03 Jul 2015 08:54:28 +0000 Subject: [patch] drm/radeon: fix underflow in r600_cp_dispatch_texture() Message-Id: <20150703085428.GB11901@mwanda> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Alex Deucher Cc: kernel-janitors@vger.kernel.org, Christian =?iso-8859-1?Q?K=F6nig?= , dri-devel@lists.freedesktop.org The "if (pass_size > buf->total)" can underflow so I have changed the type of size and pass_size to unsigned to avoid this problem. Signed-off-by: Dan Carpenter --- This code is on the way out, but whatever. I may as well send this patch since I already wrote the patch. diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c index 09e3f39..98f9ada 100644 --- a/drivers/gpu/drm/radeon/r600_cp.c +++ b/drivers/gpu/drm/radeon/r600_cp.c @@ -2483,7 +2483,7 @@ int r600_cp_dispatch_texture(struct drm_device *dev, struct drm_buf *buf; u32 *buffer; const u8 __user *data; - int size, pass_size; + unsigned int size, pass_size; u64 src_offset, dst_offset; if (!radeon_check_offset(dev_priv, tex->offset)) { From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] drm/radeon: fix underflow in r600_cp_dispatch_texture() Date: Fri, 3 Jul 2015 11:54:28 +0300 Message-ID: <20150703085428.GB11901@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by gabe.freedesktop.org (Postfix) with ESMTPS id 379E86E1E4 for ; Fri, 3 Jul 2015 01:54:47 -0700 (PDT) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Alex Deucher Cc: kernel-janitors@vger.kernel.org, Christian =?iso-8859-1?Q?K=F6nig?= , dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org VGhlICJpZiAocGFzc19zaXplID4gYnVmLT50b3RhbCkiIGNhbiB1bmRlcmZsb3cgc28gSSBoYXZl IGNoYW5nZWQgdGhlCnR5cGUgb2Ygc2l6ZSBhbmQgcGFzc19zaXplIHRvIHVuc2lnbmVkIHRvIGF2 b2lkIHRoaXMgcHJvYmxlbS4KClNpZ25lZC1vZmYtYnk6IERhbiBDYXJwZW50ZXIgPGRhbi5jYXJw ZW50ZXJAb3JhY2xlLmNvbT4KLS0tClRoaXMgY29kZSBpcyBvbiB0aGUgd2F5IG91dCwgYnV0IHdo YXRldmVyLiAgSSBtYXkgYXMgd2VsbCBzZW5kIHRoaXMKcGF0Y2ggc2luY2UgSSBhbHJlYWR5IHdy b3RlIHRoZSBwYXRjaC4KCmRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vcmFkZW9uL3I2MDBf Y3AuYyBiL2RyaXZlcnMvZ3B1L2RybS9yYWRlb24vcjYwMF9jcC5jCmluZGV4IDA5ZTNmMzkuLjk4 ZjlhZGEgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS9yYWRlb24vcjYwMF9jcC5jCisrKyBi L2RyaXZlcnMvZ3B1L2RybS9yYWRlb24vcjYwMF9jcC5jCkBAIC0yNDgzLDcgKzI0ODMsNyBAQCBp bnQgcjYwMF9jcF9kaXNwYXRjaF90ZXh0dXJlKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsCiAJc3Ry dWN0IGRybV9idWYgKmJ1ZjsKIAl1MzIgKmJ1ZmZlcjsKIAljb25zdCB1OCBfX3VzZXIgKmRhdGE7 Ci0JaW50IHNpemUsIHBhc3Nfc2l6ZTsKKwl1bnNpZ25lZCBpbnQgc2l6ZSwgcGFzc19zaXplOwog CXU2NCBzcmNfb2Zmc2V0LCBkc3Rfb2Zmc2V0OwogCiAJaWYgKCFyYWRlb25fY2hlY2tfb2Zmc2V0 KGRldl9wcml2LCB0ZXgtPm9mZnNldCkpIHsKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMu ZnJlZWRlc2t0b3Aub3JnCmh0dHA6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0 aW5mby9kcmktZGV2ZWwK