aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/char/drm/radeon_cp.c
diff options
context:
space:
mode:
authorMichel Dänzer <michel@tungstengraphics.com>2007-02-18 18:03:21 +1100
committerDave Airlie <airlied@linux.ie>2007-03-11 12:07:17 +1100
commit80b2c386f3d8c3367533a8600b599f8686c9d386 (patch)
tree348ad7e0937f79bf58821aa96afa46ed702bd8d7 /drivers/char/drm/radeon_cp.c
parentcd839d0048c3cb332cb0cd7d3de3431f8e1d3c7a (diff)
downloadkernel_samsung_smdk4412-80b2c386f3d8c3367533a8600b599f8686c9d386.zip
kernel_samsung_smdk4412-80b2c386f3d8c3367533a8600b599f8686c9d386.tar.gz
kernel_samsung_smdk4412-80b2c386f3d8c3367533a8600b599f8686c9d386.tar.bz2
drm/radeon: Fix u32 overflows when determining AGP base address in card space.
The overflows could lead to the AGP aperture overlapping the framebuffer are in the card's address space when the latter is located at the very end of th 32 bit address space, which would result in a freeze on X server startup, probably because the card read commands from the framebuffer instead of from AGP. See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=392915 . Signed-off-by: Dave Airlie <airlied@linux.ie>
Diffstat (limited to 'drivers/char/drm/radeon_cp.c')
-rw-r--r--drivers/char/drm/radeon_cp.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 5ed9656..c1850ec 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -1560,8 +1560,8 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
if (dev_priv->flags & RADEON_IS_AGP) {
base = dev->agp->base;
/* Check if valid */
- if ((base + dev_priv->gart_size) > dev_priv->fb_location &&
- base < (dev_priv->fb_location + dev_priv->fb_size)) {
+ if ((base + dev_priv->gart_size - 1) >= dev_priv->fb_location &&
+ base < (dev_priv->fb_location + dev_priv->fb_size - 1)) {
DRM_INFO("Can't use AGP base @0x%08lx, won't fit\n",
dev->agp->base);
base = 0;
@@ -1571,8 +1571,8 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
/* If not or if AGP is at 0 (Macs), try to put it elsewhere */
if (base == 0) {
base = dev_priv->fb_location + dev_priv->fb_size;
- if (((base + dev_priv->gart_size) & 0xfffffffful)
- < base)
+ if (base < dev_priv->fb_location ||
+ ((base + dev_priv->gart_size) & 0xfffffffful) < base)
base = dev_priv->fb_location
- dev_priv->gart_size;
}