Attachment 6682 Details for Bug 7595 – Handle u32 overflows in radeon_check_and_fixup_offset()

[patch] Handle u32 overflows in radeon_check_and_fixup_offset()

radeon-check_and_fixup-overflow.diff (text/plain), 1.97 KB, created by Michel Dänzer on 2006-08-25 02:42:50 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michel Dänzer

Created: 2006-08-25 02:42:50 UTC

Size: 1.97 KB

patch

obsolete

>diff --git a/shared-core/radeon_state.c b/shared-core/radeon_state.c
>index 58251dd..38b8714 100644
>--- a/shared-core/radeon_state.c
>+++ b/shared-core/radeon_state.c
>@@ -42,7 +42,11 @@ static __inline__ int radeon_check_and_f
> 						    drm_file_t * filp_priv,
> 						    u32 * offset)
> {
>-	u32 off = *offset;
>+	u64 off = *offset;
>+	u32 fb_start = dev_priv->fb_location;
>+	u32 fb_end = fb_start + dev_priv->fb_size - 1;
>+	u32 gart_start = dev_priv->gart_vm_start;
>+	u32 gart_end = gart_start + dev_priv->gart_size - 1;
> 	struct drm_radeon_driver_file_fields *radeon_priv;
> 
> 	/* Hrm ... the story of the offset ... So this function converts
>@@ -62,10 +66,8 @@ static __inline__ int radeon_check_and_f
> 	/* First, the best case, the offset already lands in either the
> 	 * framebuffer or the GART mapped space
> 	 */
>-	if ((off >= dev_priv->fb_location &&
>-	     off < (dev_priv->fb_location + dev_priv->fb_size)) ||
>-	    (off >= dev_priv->gart_vm_start &&
>-	     off < (dev_priv->gart_vm_start + dev_priv->gart_size)))
>+	if ((off >= fb_start && off <= fb_end) ||
>+	    (off >= gart_start && off <= gart_end))
> 		return 0;
> 
> 	/* Ok, that didn't happen... now check if we have a zero based
>@@ -78,16 +80,13 @@ static __inline__ int radeon_check_and_f
> 	}
> 
> 	/* Finally, assume we aimed at a GART offset if beyond the fb */
>-	if (off > (dev_priv->fb_location + dev_priv->fb_size))
>-		off = off - (dev_priv->fb_location + dev_priv->fb_size) +
>-			dev_priv->gart_vm_start;
>+	if (off > fb_end)
>+		off = off - fb_end - 1 + gart_start;
> 
> 	/* Now recheck and fail if out of bounds */
>-	if ((off >= dev_priv->fb_location &&
>-	     off < (dev_priv->fb_location + dev_priv->fb_size)) ||
>-	    (off >= dev_priv->gart_vm_start &&
>-	     off < (dev_priv->gart_vm_start + dev_priv->gart_size))) {
>-		DRM_DEBUG("offset fixed up to 0x%x\n", off);
>+	if ((off >= fb_start && off <= fb_end) ||
>+	    (off >= gart_start && off <= gart_end)) {
>+		DRM_DEBUG("offset fixed up to 0x%x\n", (unsigned int)off);
> 		*offset = off;
> 		return 0;
> 	}

Actions: View | Splinter Review

Attachments on bug 7595: 6301 | 6302 | 6305 | 6311 | 6312 | 6315 | 6405 | 6682

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.