| commit | a27bb4b209dd6c327fa4e7185f2487f9508a58db | [log] [tgz] |
|---|---|---|
| author | Marek Olšák <maraeo@gmail.com> | Fri Jun 10 14:41:26 2011 +0000 |
| committer | Dave Airlie <airlied@redhat.com> | Tue Jun 14 10:59:03 2011 +1000 |
| tree | 2c4ff2f2ded3beaaa74ef16047d5ab405e30d906 | |
| parent | ab21e60beaa96f2c55604f633dfe74076c531df7 [diff] |
drm/radeon/kms: do bounds checking for 3D_LOAD_VBPNTR and bump array limit To my knowledge, the limit is 16 on r300. (the docs don't say what the limit is) The lack of bounds checking can be abused to do all sorts of things (from bypassing parts of the CS checker to crashing the kernel). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=36745 Cc: stable@kernel.org Signed-off-by: Marek Olšák <maraeo@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>