From a08343e3e053d5ab27398013781f489cdf7f60de Mon Sep 17 00:00:00 2001 From: Thomas Hellstrom Date: Mon, 18 Apr 2005 08:26:00 +0000 Subject: VIA: 1) Security fix: Stopped possible MMIO access to PCI DMA area for the unichrome Pro. 2) Fixed an odd cpu usage problem by padding small AGP DMA submissions. Bumped patchlevel. --- shared/via_verifier.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'shared/via_verifier.c') diff --git a/shared/via_verifier.c b/shared/via_verifier.c index 742d7cea..ed14b1c6 100644 --- a/shared/via_verifier.c +++ b/shared/via_verifier.c @@ -28,8 +28,10 @@ * be very slow. */ -#include "via.h" + + #include "via_3d_reg.h" +#include "via.h" #include "drmP.h" #include "drm.h" #include "via_drm.h" @@ -693,11 +695,12 @@ via_parse_header2( drm_via_private_t *dev_priv, uint32_t const **buffer, const u VIA_WRITE(HC_REG_TRANS_SET + HC_REG_BASE, *buf++); switch(cmd) { case HC_ParaType_CmdVdata: - while ((*fire_count < dev_priv->num_fire_offsets) && + while ((buf < buf_end) && + (*fire_count < dev_priv->num_fire_offsets) && (*buf & HC_ACMD_MASK) == HC_ACMD_HCmdB ) { while(buf <= next_fire) { - VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + (burst & 63), *buf++); - burst += 4; + VIA_WRITE(HC_REG_TRANS_SPACE + HC_REG_BASE + (burst & 63), *buf++); + burst += 4; } if ( ( buf < buf_end ) && ((*buf & HALCYON_FIREMASK) == HALCYON_FIRECMD)) buf++; @@ -731,6 +734,10 @@ verify_mmio_address( uint32_t address) DRM_ERROR("Invalid VIDEO DMA command. " "Attempt to access 3D- or command burst area.\n"); return 1; + } else if ((address > 0xCFF) && (address < 0x1300)) { + DRM_ERROR("Invalid VIDEO DMA command. " + "Attempt to access PCI DMA area.\n"); + return 1; } else if (address > 0x13FF ) { DRM_ERROR("Invalid VIDEO DMA command. " "Attempt to access VGA registers.\n"); -- cgit v1.2.3