diff options
| author | Marek Olšák <maraeo@gmail.com> | 2011-02-14 01:01:10 +0100 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2011-02-14 10:12:14 +1000 |
| commit | fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef (patch) | |
| tree | 67b3cf58e6b1a23a81bd45b1c98455020f6db248 /drivers/gpu/drm/radeon/r100.c | |
| parent | 501834349e872ed4115eea3beef65ca9eeb5528e (diff) | |
| download | kernel_samsung_smdk4412-fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef.zip kernel_samsung_smdk4412-fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef.tar.gz kernel_samsung_smdk4412-fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef.tar.bz2 | |
drm/radeon/kms: check AA resolve registers on r300
This is an important security fix because we allowed arbitrary values
to be passed to AARESOLVE_OFFSET. This also puts the right buffer address
in the register.
Signed-off-by: Marek Olšák <maraeo@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/radeon/r100.c')
| -rw-r--r-- | drivers/gpu/drm/radeon/r100.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c index fdf4bc6..56deae5 100644 --- a/drivers/gpu/drm/radeon/r100.c +++ b/drivers/gpu/drm/radeon/r100.c @@ -3381,6 +3381,26 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track) } track->zb_dirty = false; + if (track->aa_dirty && track->aaresolve) { + if (track->aa.robj == NULL) { + DRM_ERROR("[drm] No buffer for AA resolve buffer %d !\n", i); + return -EINVAL; + } + /* I believe the format comes from colorbuffer0. */ + size = track->aa.pitch * track->cb[0].cpp * track->maxy; + size += track->aa.offset; + if (size > radeon_bo_size(track->aa.robj)) { + DRM_ERROR("[drm] Buffer too small for AA resolve buffer %d " + "(need %lu have %lu) !\n", i, size, + radeon_bo_size(track->aa.robj)); + DRM_ERROR("[drm] AA resolve buffer %d (%u %u %u %u)\n", + i, track->aa.pitch, track->cb[0].cpp, + track->aa.offset, track->maxy); + return -EINVAL; + } + } + track->aa_dirty = false; + prim_walk = (track->vap_vf_cntl >> 4) & 0x3; if (track->vap_vf_cntl & (1 << 14)) { nverts = track->vap_alt_nverts; @@ -3455,6 +3475,7 @@ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track track->cb_dirty = true; track->zb_dirty = true; track->tex_dirty = true; + track->aa_dirty = true; if (rdev->family < CHIP_R300) { track->num_cb = 1; @@ -3469,6 +3490,8 @@ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track track->num_texture = 16; track->maxy = 4096; track->separate_cube = 0; + track->aaresolve = true; + track->aa.robj = NULL; } for (i = 0; i < track->num_cb; i++) { |