summaryrefslogtreecommitdiff
path: root/linux
diff options
context:
space:
mode:
authorJeff Hartmann <jhartmann@valinux.com>2001-07-20 22:16:04 +0000
committerJeff Hartmann <jhartmann@valinux.com>2001-07-20 22:16:04 +0000
commit5e8ba79eb6aabd85f52de43fcf30722268857f60 (patch)
treeeb78245049182c1d482391b0d043ad9f8cd79524 /linux
parentae5b4effc05cd5ac44ab44c5c733c6599652f1eb (diff)
Merge checker fixes from Alan Cox made to the drm in the ac kernel tree.
These aren't really security problems, but Alan has made some arguments that have convinced me that the code should be fixed anyway.
Diffstat (limited to 'linux')
-rw-r--r--linux/drm_bufs.h19
-rw-r--r--linux/drm_ioctl.h2
2 files changed, 20 insertions, 1 deletions
diff --git a/linux/drm_bufs.h b/linux/drm_bufs.h
index 16af7bd5..02502321 100644
--- a/linux/drm_bufs.h
+++ b/linux/drm_bufs.h
@@ -332,6 +332,12 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp,
return -ENOMEM; /* May only call once for each order */
}
+ if (count < 0 || count > 4096) {
+ up( &dev->struct_sem );
+ atomic_dec( &dev->buf_alloc );
+ return -EINVAL;
+ }
+
entry->buflist = DRM(alloc)( count * sizeof(*entry->buflist),
DRM_MEM_BUFS );
if ( !entry->buflist ) {
@@ -479,6 +485,12 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp,
return -ENOMEM; /* May only call once for each order */
}
+ if (count < 0 || count > 4096) {
+ up( &dev->struct_sem );
+ atomic_dec( &dev->buf_alloc );
+ return -EINVAL;
+ }
+
entry->buflist = DRM(alloc)( count * sizeof(*entry->buflist),
DRM_MEM_BUFS );
if ( !entry->buflist ) {
@@ -581,6 +593,7 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp,
atomic_dec( &dev->buf_alloc );
return 0;
+
}
#endif /* __HAVE_PCI_DMA */
@@ -650,6 +663,12 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp,
return -ENOMEM; /* May only call once for each order */
}
+ if (count < 0 || count > 4096) {
+ up( &dev->struct_sem );
+ atomic_dec( &dev->buf_alloc );
+ return -EINVAL;
+ }
+
entry->buflist = DRM(alloc)( count * sizeof(*entry->buflist),
DRM_MEM_BUFS );
if ( !entry->buflist ) {
diff --git a/linux/drm_ioctl.h b/linux/drm_ioctl.h
index 1cc8f31f..c2761808 100644
--- a/linux/drm_ioctl.h
+++ b/linux/drm_ioctl.h
@@ -82,7 +82,7 @@ int DRM(setunique)(struct inode *inode, struct file *filp,
if (copy_from_user(&u, (drm_unique_t *)arg, sizeof(u)))
return -EFAULT;
- if (!u.unique_len)
+ if (!u.unique_len || u.unique_len > 1024)
return -EINVAL;
dev->unique_len = u.unique_len;