summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDave Airlie <airlied@linux.ie>2004-04-08 12:05:25 +0000
committerDave Airlie <airlied@linux.ie>2004-04-08 12:05:25 +0000
commitbc1428035ceb5300df429d09a64a20a2a7e903b2 (patch)
treebc49b454b6b8e144fc6722badeafd4a295a46d18
parentee2889ec0d2f8b6138f916df3c3d8b7e208cc1f7 (diff)
fixes from Linux kernel
-rw-r--r--shared-core/r128_state.c11
-rw-r--r--shared-core/radeon_state.c15
-rw-r--r--shared/r128_state.c11
-rw-r--r--shared/radeon_state.c15
4 files changed, 48 insertions, 4 deletions
diff --git a/shared-core/r128_state.c b/shared-core/r128_state.c
index f411657f..dcacb0f3 100644
--- a/shared-core/r128_state.c
+++ b/shared-core/r128_state.c
@@ -915,6 +915,9 @@ static int r128_cce_dispatch_write_span( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count>4096 || count<=0)
+ return -EMSGSIZE;
+
if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
return DRM_ERR(EFAULT);
}
@@ -1008,6 +1011,8 @@ static int r128_cce_dispatch_write_pixels( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
xbuf_size = count * sizeof(*x);
ybuf_size = count * sizeof(*y);
@@ -1125,6 +1130,9 @@ static int r128_cce_dispatch_read_span( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
+
if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
return DRM_ERR(EFAULT);
}
@@ -1167,6 +1175,9 @@ static int r128_cce_dispatch_read_pixels( drm_device_t *dev,
DRM_DEBUG( "%s\n", __FUNCTION__ );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
+
if ( count > dev_priv->depth_pitch ) {
count = dev_priv->depth_pitch;
}
diff --git a/shared-core/radeon_state.c b/shared-core/radeon_state.c
index 0ed1f53d..fca72827 100644
--- a/shared-core/radeon_state.c
+++ b/shared-core/radeon_state.c
@@ -1497,7 +1497,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
/* Update the input parameters for next time */
image->y += height;
image->height -= height;
- (const u8 *)image->data += size;
+ image->data = (const u8 *)image->data + size;
} while (image->height > 0);
/* Flush the pixel cache after the blit completes. This ensures
@@ -2485,10 +2485,21 @@ int radeon_cp_getparam( DRM_IOCTL_ARGS )
case RADEON_PARAM_STATUS_HANDLE:
value = dev_priv->ring_rptr_offset;
break;
+#if BITS_PER_LONG == 32
+ /*
+ * This ioctl() doesn't work on 64-bit platforms because hw_lock is a
+ * pointer which can't fit into an int-sized variable. According to
+ * Michel Dänzer, the ioctl() is only used on embedded platforms, so
+ * not supporting it shouldn't be a problem. If the same functionality
+ * is needed on 64-bit platforms, a new ioctl() would have to be added,
+ * so backwards-compatibility for the embedded platforms can be
+ * maintained. --davidm 4-Feb-2004.
+ */
case RADEON_PARAM_SAREA_HANDLE:
/* The lock is the first dword in the sarea. */
- value = (int)dev->lock.hw_lock;
+ value = (long)dev->lock.hw_lock;
break;
+#endif
case RADEON_PARAM_GART_TEX_HANDLE:
value = dev_priv->gart_textures_offset;
break;
diff --git a/shared/r128_state.c b/shared/r128_state.c
index f411657f..dcacb0f3 100644
--- a/shared/r128_state.c
+++ b/shared/r128_state.c
@@ -915,6 +915,9 @@ static int r128_cce_dispatch_write_span( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count>4096 || count<=0)
+ return -EMSGSIZE;
+
if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
return DRM_ERR(EFAULT);
}
@@ -1008,6 +1011,8 @@ static int r128_cce_dispatch_write_pixels( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
xbuf_size = count * sizeof(*x);
ybuf_size = count * sizeof(*y);
@@ -1125,6 +1130,9 @@ static int r128_cce_dispatch_read_span( drm_device_t *dev,
DRM_DEBUG( "\n" );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
+
if ( DRM_COPY_FROM_USER( &x, depth->x, sizeof(x) ) ) {
return DRM_ERR(EFAULT);
}
@@ -1167,6 +1175,9 @@ static int r128_cce_dispatch_read_pixels( drm_device_t *dev,
DRM_DEBUG( "%s\n", __FUNCTION__ );
count = depth->n;
+ if (count > 4096 || count <= 0)
+ return -EMSGSIZE;
+
if ( count > dev_priv->depth_pitch ) {
count = dev_priv->depth_pitch;
}
diff --git a/shared/radeon_state.c b/shared/radeon_state.c
index 0ed1f53d..fca72827 100644
--- a/shared/radeon_state.c
+++ b/shared/radeon_state.c
@@ -1497,7 +1497,7 @@ static int radeon_cp_dispatch_texture( DRMFILE filp,
/* Update the input parameters for next time */
image->y += height;
image->height -= height;
- (const u8 *)image->data += size;
+ image->data = (const u8 *)image->data + size;
} while (image->height > 0);
/* Flush the pixel cache after the blit completes. This ensures
@@ -2485,10 +2485,21 @@ int radeon_cp_getparam( DRM_IOCTL_ARGS )
case RADEON_PARAM_STATUS_HANDLE:
value = dev_priv->ring_rptr_offset;
break;
+#if BITS_PER_LONG == 32
+ /*
+ * This ioctl() doesn't work on 64-bit platforms because hw_lock is a
+ * pointer which can't fit into an int-sized variable. According to
+ * Michel Dänzer, the ioctl() is only used on embedded platforms, so
+ * not supporting it shouldn't be a problem. If the same functionality
+ * is needed on 64-bit platforms, a new ioctl() would have to be added,
+ * so backwards-compatibility for the embedded platforms can be
+ * maintained. --davidm 4-Feb-2004.
+ */
case RADEON_PARAM_SAREA_HANDLE:
/* The lock is the first dword in the sarea. */
- value = (int)dev->lock.hw_lock;
+ value = (long)dev->lock.hw_lock;
break;
+#endif
case RADEON_PARAM_GART_TEX_HANDLE:
value = dev_priv->gart_textures_offset;
break;