This is a note to let you know that I've just added the patch titled
drm/radeon/kms: add some sanity checks to obj info record parsingi (v2)
to the 2.6.38-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-radeon-kms-add-some-sanity-checks-to-obj-info-record-parsingi-v2.patch
and it can be found in the queue-2.6.38 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 97ea530f6fac1f9632b0c4792a2a56411454adbe Mon Sep 17 00:00:00 2001
From: John Lindgren <[email protected]>
Date: Thu, 24 Mar 2011 23:28:31 +0000
Subject: drm/radeon/kms: add some sanity checks to obj info record parsingi (v2)
From: John Lindgren <[email protected]>
commit 97ea530f6fac1f9632b0c4792a2a56411454adbe upstream.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=35502
agd5f: also add sanity check to connector records.
v2: fix one more case.
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -675,7 +675,8 @@ bool radeon_get_atom_connector_info_from
ATOM_ENCODER_CAP_RECORD
*cap_record;
u16 caps = 0;
- while
(record->ucRecordType > 0 &&
+ while
(record->ucRecordSize > 0 &&
+
record->ucRecordType > 0 &&
record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
switch
(record->ucRecordType) {
case
ATOM_ENCODER_CAP_RECORD_TYPE:
@@ -720,7 +721,8 @@ bool radeon_get_atom_connector_info_from
break;
}
- while
(record->ucRecordType > 0 &&
+ while
(record->ucRecordSize > 0 &&
+
record->ucRecordType > 0 &&
record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) {
switch
(record->ucRecordType) {
case
ATOM_I2C_RECORD_TYPE:
@@ -782,10 +784,9 @@ bool radeon_get_atom_connector_info_from
ATOM_HPD_INT_RECORD *hpd_record;
ATOM_I2C_ID_CONFIG_ACCESS
*i2c_config;
- while (record->ucRecordType > 0
- && record->
- ucRecordType <=
-
ATOM_MAX_OBJECT_RECORD_NUMBER) {
+ while (record->ucRecordSize > 0
&&
+ record->ucRecordType > 0
&&
+ record->ucRecordType <=
ATOM_MAX_OBJECT_RECORD_NUMBER) {
switch
(record->ucRecordType) {
case
ATOM_I2C_RECORD_TYPE:
i2c_record =
Patches currently in stable-queue which might be from [email protected] are
queue-2.6.38/drm-radeon-kms-add-some-sanity-checks-to-obj-info-record-parsingi-v2.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
