summaryrefslogtreecommitdiff
path: root/shared-core
diff options
context:
space:
mode:
authorThomas Hellstrom <unichrome@shipmail.org>2004-12-06 11:19:23 +0000
committerThomas Hellstrom <unichrome@shipmail.org>2004-12-06 11:19:23 +0000
commit1fbfd9eb32220a10d66373b77172965cfeccd4f7 (patch)
treeb3d575f5a2a104b28aece230c6983e88c8d66908 /shared-core
parent267e0645272720344eb7556a948e72112edbe2ec (diff)
Security and optimization fixes for the via drm:
1. The command verifier was never initialized in the non-core source tree. 2. Check added that the AGP ring buffer has been initialized before accepting command buffer. 3. Free space check in the AGP buffer is moved to after command verification, which is more optimal in most cases.
Diffstat (limited to 'shared-core')
-rw-r--r--shared-core/via_dma.c18
-rw-r--r--shared-core/via_drv.h4
2 files changed, 15 insertions, 7 deletions
diff --git a/shared-core/via_dma.c b/shared-core/via_dma.c
index 0c2ac470..ac7b7bea 100644
--- a/shared-core/via_dma.c
+++ b/shared-core/via_dma.c
@@ -170,19 +170,22 @@ int via_dma_init(DRM_IOCTL_ARGS)
static int via_dispatch_cmdbuffer(drm_device_t * dev, drm_via_cmdbuffer_t * cmd)
{
- drm_via_private_t *dev_priv = dev->dev_private;
+ drm_via_private_t *dev_priv;
uint32_t *vb;
int ret;
+ dev_priv = (drm_via_private_t *) dev->dev_private;
+
+ if (dev_priv->ring.virtual_start == NULL) {
+ DRM_ERROR("%s called without initializing AGP ring buffer.\n",
+ __FUNCTION__);
+ return DRM_ERR(EFAULT);
+ }
if (cmd->size > pci_bufsiz && pci_bufsiz > 0) {
return DRM_ERR(ENOMEM);
}
- vb = via_check_dma(dev_priv, cmd->size);
- if (vb == NULL) {
- return DRM_ERR(EAGAIN);
- }
if (DRM_COPY_FROM_USER(pci_buf, cmd->buf, cmd->size))
return DRM_ERR(EFAULT);
@@ -198,6 +201,11 @@ static int via_dispatch_cmdbuffer(drm_device_t * dev, drm_via_cmdbuffer_t * cmd)
return ret;
}
+ vb = via_check_dma(dev_priv, cmd->size);
+ if (vb == NULL) {
+ return DRM_ERR(EAGAIN);
+ }
+
memcpy(vb, pci_buf, cmd->size);
dev_priv->dma_low += cmd->size;
diff --git a/shared-core/via_drv.h b/shared-core/via_drv.h
index 13a93b78..e905a606 100644
--- a/shared-core/via_drv.h
+++ b/shared-core/via_drv.h
@@ -28,11 +28,11 @@
#define DRIVER_NAME "via"
#define DRIVER_DESC "VIA Unichrome"
-#define DRIVER_DATE "20041204"
+#define DRIVER_DATE "20041206"
#define DRIVER_MAJOR 2
#define DRIVER_MINOR 2
-#define DRIVER_PATCHLEVEL 0
+#define DRIVER_PATCHLEVEL 1
typedef struct drm_via_ring_buffer {
drm_map_t map;