This is a note to let you know that I've just added the patch titled
drm/radeon: check buffer relocation offset
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-radeon-check-buffer-relocation-offset.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 695daf1a8e731a4b5b89de89a61f32a4d7ad7094 Mon Sep 17 00:00:00 2001
From: Leo Liu <leo.liu@xxxxxxx>
Date: Mon, 28 Apr 2014 09:40:22 -0400
Subject: drm/radeon: check buffer relocation offset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Leo Liu <leo.liu@xxxxxxx>
commit 695daf1a8e731a4b5b89de89a61f32a4d7ad7094 upstream.
Signed-off-by: Leo Liu <leo.liu@xxxxxxx>
Signed-off-by: Christian König <christian.koenig@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/radeon/radeon_uvd.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -449,6 +449,10 @@ static int radeon_uvd_cs_reloc(struct ra
cmd = radeon_get_ib_value(p, p->idx) >> 1;
if (cmd < 0x4) {
+ if (end <= start) {
+ DRM_ERROR("invalid reloc offset %X!\n", offset);
+ return -EINVAL;
+ }
if ((end - start) < buf_sizes[cmd]) {
DRM_ERROR("buffer to small (%d / %d)!\n",
(unsigned)(end - start), buf_sizes[cmd]);
Patches currently in stable-queue which might be from leo.liu@xxxxxxx are
queue-3.10/drm-radeon-check-buffer-relocation-offset.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html