Commit 695daf1a authored by Leo Liu's avatar Leo Liu Committed by Christian König

drm/radeon: check buffer relocation offset

Signed-off-by: default avatarLeo Liu <leo.liu@amd.com>
Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
Cc: stable@vger.kernel.org
parent f5d636d2
...@@ -465,6 +465,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p, ...@@ -465,6 +465,10 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
cmd = radeon_get_ib_value(p, p->idx) >> 1; cmd = radeon_get_ib_value(p, p->idx) >> 1;
if (cmd < 0x4) { if (cmd < 0x4) {
if (end <= start) {
DRM_ERROR("invalid reloc offset %X!\n", offset);
return -EINVAL;
}
if ((end - start) < buf_sizes[cmd]) { if ((end - start) < buf_sizes[cmd]) {
DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd, DRM_ERROR("buffer (%d) to small (%d / %d)!\n", cmd,
(unsigned)(end - start), buf_sizes[cmd]); (unsigned)(end - start), buf_sizes[cmd]);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment