diff options
Diffstat (limited to 'patches/radeon-kms-sanity-checks.patch')
| -rw-r--r-- | patches/radeon-kms-sanity-checks.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/patches/radeon-kms-sanity-checks.patch b/patches/radeon-kms-sanity-checks.patch new file mode 100644 index 0000000..03c4bbc --- /dev/null +++ b/patches/radeon-kms-sanity-checks.patch @@ -0,0 +1,43 @@ +From 80090ba2d9eab1de4eb09ca5d40697b0f039a9c9 Mon Sep 17 00:00:00 2001 +From: John Lindgren <john.lindgren@tds.net> +Date: Tue, 22 Mar 2011 18:15:10 -0400 +Subject: [PATCH] drm/radeon/kms: add some sanity checks to obj info record parsing + +Fixes: +https://bugs.freedesktop.org/show_bug.cgi?id=35502 + +agd5f: also add sanity check to connector records. + +Signed-off-by: Alex Deucher <alexdeucher@gmail.com> +Cc: stable@kernel.org +--- + drivers/gpu/drm/radeon/radeon_atombios.c | 6 ++++-- + 1 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index 4a92b6d..793bbd7 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -678,7 +678,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) + ATOM_ENCODER_CAP_RECORD *cap_record; + u16 caps = 0; + +- while (record->ucRecordType > 0 && ++ while (record->ucRecordSize > 0 && ++ record->ucRecordType > 0 && + record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) { + switch (record->ucRecordType) { + case ATOM_ENCODER_CAP_RECORD_TYPE: +@@ -723,7 +724,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev) + break; + } + +- while (record->ucRecordType > 0 && ++ while (record->ucRecordSize > 0 && ++ record->ucRecordType > 0 && + record->ucRecordType <= ATOM_MAX_OBJECT_RECORD_NUMBER) { + switch (record->ucRecordType) { + case ATOM_I2C_RECORD_TYPE: +-- +1.7.1.1 + |