From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?ISO-8859-1?Q?Christian_K=F6nig?= Subject: Re: [PATCH] drm/radeon: check buffer relocation offset Date: Mon, 28 Apr 2014 16:17:39 +0200 Message-ID: <535E6303.2000608@vodafone.de> References: <1398692422-14849-1-git-send-email-leo.liu@amd.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from pegasos-out.vodafone.de (pegasos-out.vodafone.de [80.84.1.38]) by gabe.freedesktop.org (Postfix) with ESMTP id 428646E857 for ; Mon, 28 Apr 2014 07:17:53 -0700 (PDT) In-Reply-To: <1398692422-14849-1-git-send-email-leo.liu@amd.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Leo Liu , dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org Am 28.04.2014 15:40, schrieb Leo Liu: > Signed-off-by: Leo Liu > Cc:stable@vger.kernel.org There should be a space between the "CC:" and "stable@vger.kernel.org" > --- > drivers/gpu/drm/radeon/radeon_uvd.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c > index 5748bda..0f96c47 100644 > --- a/drivers/gpu/drm/radeon/radeon_uvd.c > +++ b/drivers/gpu/drm/radeon/radeon_uvd.c > @@ -465,6 +465,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p, > cmd = radeon_get_ib_value(p, p->idx) >> 1; > > if (cmd < 0x4) { > + if (end <= start) { > + DRM_ERROR("invalid reloc offset %X!\n", offset); > + return -EINVAL; > + } No idea where that came from (mail client or your editor), but checkpatch.pl complained that those new lines ended with DOS line endings. Anyway I've fixed those minor problems and applied it to my 3.15 queue. Thanks, Christian. > if ((end - start) < buf_sizes[cmd]) { > DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd, > (unsigned)(end - start), buf_sizes[cmd]);