This pull request brings in a few little error checking fixes and one

slow memory leak fix.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE/JuuFDWp9/ZkuCBXtdYpNtH8nugFAliGm/wACgkQtdYpNtH8
 nuiZ6w/+KZBAJnxJvtc/vgOGuFaao/fgkAU1A62ADKZH6+6MKwajmm3r4UuzqolQ
 Hv7SFkZpbfpovvoWnLgjoQCT/IS6VRyfs+C46mUhgRvsQh0OlrDPEd5EVTIqo0or
 VsujheLNwBcP6Pv6KXIPa4lxSkG1HzZTw/yUdgDRYC0Wr++hy1skSn3HB+G0sjid
 J9tFz3JiB01zyDL/wWAzt17/ERzLyIbx2kawNbVf+VJEuhFJlbsGg4CW/eKp/0hR
 9mU0JN54l7cN4i130aaqI+KuVBKEPUpRb1PvHGPkAa6+nH9mo4N/GYroPWzJqigJ
 W4Pb4FniKhtiI8ZZ0+sPRIsUyR3K3All1efLtRQ9zEjJE4DFYL5Sscam9IWFpN/C
 e3cf487K0Fd1+YXHEn8rSb2xJj+wmAGbNuqSScB27AqWH9L5XN/mETsgSkeGaGaA
 BNv8+Z/Il226BUaDRbAkcCB+C4v77W/t0c5ngcdVc0UQV8ZuVLoK9tM8hqGEcQNP
 T0ut54B1VGGxb0lnaqo4j2iem+c+bEvO1XV5E93uh1HCo0IQAByt64/uVoSzfVxl
 pTUhXQZvPV8RqcMmCxlPzbyoUSoPZEASNqEv8RhaqrgR5+1UgdKF3vBHZy435OVL
 svVu3yfZ1WvX1a1YgoQlL+yRLPQIRWmGcNheqO6vTCyXCrcIitw=
 =JDVv
 -----END PGP SIGNATURE-----

Merge tag 'drm-vc4-fixes-2017-01-23' of https://github.com/anholt/linux into drm-fixes

This pull request brings in a few little error checking fixes and one
slow memory leak fix.

* tag 'drm-vc4-fixes-2017-01-23' of https://github.com/anholt/linux:
  drm/vc4: Return -EINVAL on the overflow checks failing.
  drm/vc4: Fix an integer overflow in temporary allocation layout.
  drm/vc4: fix a bounds check
  drm/vc4: Fix memory leak of the CRTC state.
This commit is contained in:
Dave Airlie 2017-01-27 10:33:39 +10:00
commit e996598b28
3 changed files with 5 additions and 3 deletions

View File

@ -839,7 +839,7 @@ static void vc4_crtc_destroy_state(struct drm_crtc *crtc,
}
__drm_atomic_helper_crtc_destroy_state(state);
drm_atomic_helper_crtc_destroy_state(crtc, state);
}
static const struct drm_crtc_funcs vc4_crtc_funcs = {

View File

@ -594,12 +594,14 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
args->shader_rec_count);
struct vc4_bo *bo;
if (uniforms_offset < shader_rec_offset ||
if (shader_rec_offset < args->bin_cl_size ||
uniforms_offset < shader_rec_offset ||
exec_size < uniforms_offset ||
args->shader_rec_count >= (UINT_MAX /
sizeof(struct vc4_shader_state)) ||
temp_size < exec_size) {
DRM_ERROR("overflow in exec arguments\n");
ret = -EINVAL;
goto fail;
}

View File

@ -461,7 +461,7 @@ static int vc4_rcl_surface_setup(struct vc4_exec_info *exec,
}
ret = vc4_full_res_bounds_check(exec, *obj, surf);
if (!ret)
if (ret)
return ret;
return 0;