From patchwork Mon Apr 28 13:40:22 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leo Liu X-Patchwork-Id: 4077851 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id A9D34BFF02 for ; Mon, 28 Apr 2014 13:55:00 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E34AF202AE for ; Mon, 28 Apr 2014 13:54:59 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id E1E8F20219 for ; Mon, 28 Apr 2014 13:54:58 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 2654A6E694; Mon, 28 Apr 2014 06:54:58 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org X-Greylist: delayed 845 seconds by postgrey-1.34 at gabe; Mon, 28 Apr 2014 06:54:56 PDT Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0238.outbound.protection.outlook.com [207.46.163.238]) by gabe.freedesktop.org (Postfix) with ESMTP id 338686E694 for ; Mon, 28 Apr 2014 06:54:55 -0700 (PDT) Received: from BL2PR02CA010.namprd02.prod.outlook.com (10.141.66.20) by CO1PR02MB125.namprd02.prod.outlook.com (10.242.163.151) with Microsoft SMTP Server (TLS) id 15.0.929.12; Mon, 28 Apr 2014 13:40:49 +0000 Received: from BN1BFFO11FD034.protection.gbl (2a01:111:f400:7c10::1:176) by BL2PR02CA010.outlook.office365.com (2a01:111:e400:c1b::20) with Microsoft SMTP Server (TLS) id 15.0.929.12 via Frontend Transport; Mon, 28 Apr 2014 13:40:48 +0000 Received: from atltwp01.amd.com (165.204.84.221) by BN1BFFO11FD034.mail.protection.outlook.com (10.58.144.97) with Microsoft SMTP Server id 15.0.929.8 via Frontend Transport; Mon, 28 Apr 2014 13:40:48 +0000 X-WSS-ID: 0N4QTZZ-07-W8D-02 X-M-MSG: Received: from satlvexedge02.amd.com (satlvexedge02.amd.com [10.177.96.29]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by atltwp01.amd.com (Axway MailGate 5.3.1) with ESMTPS id 20E6ACAE627 for ; Mon, 28 Apr 2014 08:40:47 -0500 (CDT) Received: from SATLEXDAG01.amd.com (10.181.40.3) by SATLVEXEDGE02.amd.com (10.177.96.29) with Microsoft SMTP Server (TLS) id 14.2.328.9; Mon, 28 Apr 2014 08:41:06 -0500 Received: from STOREXDAG02.amd.com (10.1.13.11) by SATLEXDAG01.amd.com (10.181.40.3) with Microsoft SMTP Server (TLS) id 14.2.328.9; Mon, 28 Apr 2014 09:40:47 -0400 Received: from ubuntu.amd.com (172.27.232.48) by storexdag02.amd.com (10.1.13.11) with Microsoft SMTP Server (TLS) id 14.2.328.9; Mon, 28 Apr 2014 09:40:46 -0400 From: Leo Liu To: Subject: [PATCH] drm/radeon: check buffer relocation offset Date: Mon, 28 Apr 2014 09:40:22 -0400 Message-ID: <1398692422-14849-1-git-send-email-leo.liu@amd.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-Originating-IP: [172.27.232.48] X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CIP:165.204.84.221; CTRY:US; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(10009001)(6009001)(428001)(189002)(199002)(81542001)(20776003)(92726001)(79102001)(47776003)(89996001)(93916002)(84676001)(81342001)(80022001)(85852003)(33646001)(62966002)(92566001)(101416001)(50226001)(74662001)(31966008)(77982001)(83072002)(74502001)(76482001)(80976001)(53416003)(46102001)(83322001)(19580395003)(19580405001)(44976005)(36756003)(99396002)(77156001)(86362001)(87286001)(50466002)(97736001)(87936001)(88136002)(50986999)(4396001)(48376002)(2009001); DIR:OUT; SFP:1101; SCL:1; SRVR:CO1PR02MB125; H:atltwp01.amd.com; FPR:ABAF77E.A0ED15A2.73EBABDB.D3190E01.20112; MLV:sfv; PTR:InfoDomainNonexistent; MX:1; A:1; LANG:; X-Forefront-PRVS: 01952C6E96 Received-SPF: None (: amd.com does not designate permitted sender hosts) X-OriginatorOrg: amd4.onmicrosoft.com X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Signed-off-by: Leo Liu Cc:stable@vger.kernel.org --- drivers/gpu/drm/radeon/radeon_uvd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c index 5748bda..0f96c47 100644 --- a/drivers/gpu/drm/radeon/radeon_uvd.c +++ b/drivers/gpu/drm/radeon/radeon_uvd.c @@ -465,6 +465,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p, cmd = radeon_get_ib_value(p, p->idx) >> 1; if (cmd < 0x4) { + if (end <= start) { + DRM_ERROR("invalid reloc offset %X!\n", offset); + return -EINVAL; + } if ((end - start) < buf_sizes[cmd]) { DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd, (unsigned)(end - start), buf_sizes[cmd]);