Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e996598b authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'drm-vc4-fixes-2017-01-23' of https://github.com/anholt/linux into drm-fixes 

This pull request brings in a few little error checking fixes and one
slow memory leak fix.

* tag 'drm-vc4-fixes-2017-01-23' of https://github.com/anholt/linux:
  drm/vc4: Return -EINVAL on the overflow checks failing.
  drm/vc4: Fix an integer overflow in temporary allocation layout.
  drm/vc4: fix a bounds check
  drm/vc4: Fix memory leak of the CRTC state.
parents 1fb2d354 6b8ac638

drivers/gpu/drm/vc4/vc4_crtc.c

+1 −1
Original line number Diff line number Diff line
@@ -839,7 +839,7 @@ static void vc4_crtc_destroy_state(struct drm_crtc *crtc, 


	}



	__drm_atomic_helper_crtc_destroy_state(state);

	drm_atomic_helper_crtc_destroy_state(crtc, state);

}



static const struct drm_crtc_funcs vc4_crtc_funcs = {

drivers/gpu/drm/vc4/vc4_gem.c

+3 −1
Original line number Diff line number Diff line
@@ -594,12 +594,14 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec) 
					  args->shader_rec_count);

	struct vc4_bo *bo;



	if (uniforms_offset < shader_rec_offset ||

	if (shader_rec_offset < args->bin_cl_size ||

	    uniforms_offset < shader_rec_offset ||

	    exec_size < uniforms_offset ||

	    args->shader_rec_count >= (UINT_MAX /

					  sizeof(struct vc4_shader_state)) ||

	    temp_size < exec_size) {

		DRM_ERROR("overflow in exec arguments\n");

		ret = -EINVAL;

		goto fail;

	}

drivers/gpu/drm/vc4/vc4_render_cl.c

+1 −1
Original line number Diff line number Diff line
@@ -461,7 +461,7 @@ static int vc4_rcl_surface_setup(struct vc4_exec_info *exec, 
		}



		ret = vc4_full_res_bounds_check(exec, *obj, surf);

		if (!ret)

		if (ret)

			return ret;



		return 0;