Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 841dd99c authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "drm: limit number of blob property allocation"

parents 0f75cefd 75e9ba88

drivers/gpu/drm/drm_fops.c

+7 −0
Original line number Diff line number Diff line
@@ -45,6 +45,8 @@ 
/* from BKL pushdown */

DEFINE_MUTEX(drm_global_mutex);



#define MAX_DRM_OPEN_COUNT		20



/**

 * DOC: file operations

 *
@@ -135,6 +137,11 @@ int drm_open(struct inode *inode, struct file *filp) 
	if (!dev->open_count++)

		need_setup = 1;



	if (dev->open_count >= MAX_DRM_OPEN_COUNT) {

		retcode = -EPERM;

		goto err_undo;

	}



	/* share address_space across all char-devs of a single device */

	filp->f_mapping = dev->anon_inode->i_mapping;

drivers/gpu/drm/drm_property.c

+13 −2
Original line number Diff line number Diff line
@@ -26,6 +26,9 @@ 


#include "drm_crtc_internal.h"



#define MAX_BLOB_PROP_SIZE	(PAGE_SIZE * 30)

#define MAX_BLOB_PROP_COUNT	250



/**

 * DOC: overview

 *
@@ -554,7 +557,8 @@ drm_property_create_blob(struct drm_device *dev, size_t length, 
	struct drm_property_blob *blob;

	int ret;



	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))

	if (!length || length > MAX_BLOB_PROP_SIZE -

				sizeof(struct drm_property_blob))

		return ERR_PTR(-EINVAL);



	blob = vzalloc(sizeof(struct drm_property_blob)+length);
@@ -756,13 +760,20 @@ int drm_mode_createblob_ioctl(struct drm_device *dev, 
			      void *data, struct drm_file *file_priv)

{

	struct drm_mode_create_blob *out_resp = data;

	struct drm_property_blob *blob;

	struct drm_property_blob *blob, *bt;

	void __user *blob_ptr;

	int ret = 0;

	u32 count = 0;



	if (!drm_core_check_feature(dev, DRIVER_MODESET))

		return -EINVAL;



	list_for_each_entry(bt, &file_priv->blobs, head_file)

		count++;



	if (count == MAX_BLOB_PROP_COUNT)

		return -EINVAL;



	blob = drm_property_create_blob(dev, out_resp->length, NULL);

	if (IS_ERR(blob))

		return PTR_ERR(blob);