[patch] drm/radeon: fix underflow in r600_cp_dispatch_texture()

Dan Carpenter dan.carpenter at oracle.com
Fri Jul 3 01:54:28 PDT 2015


The "if (pass_size > buf->total)" can underflow so I have changed the
type of size and pass_size to unsigned to avoid this problem.

Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
---
This code is on the way out, but whatever.  I may as well send this
patch since I already wrote the patch.

diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c
index 09e3f39..98f9ada 100644
--- a/drivers/gpu/drm/radeon/r600_cp.c
+++ b/drivers/gpu/drm/radeon/r600_cp.c
@@ -2483,7 +2483,7 @@ int r600_cp_dispatch_texture(struct drm_device *dev,
 	struct drm_buf *buf;
 	u32 *buffer;
 	const u8 __user *data;
-	int size, pass_size;
+	unsigned int size, pass_size;
 	u64 src_offset, dst_offset;
 
 	if (!radeon_check_offset(dev_priv, tex->offset)) {


More information about the dri-devel mailing list