diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2012-05-11 17:15:31 +0200 |
|---|---|---|
| committer | Arnd Bergmann <arnd@arndb.de> | 2012-05-11 17:15:31 +0200 |
| commit | 93c6d8927fa692faef3d7d945bd4fe84b0185ad4 (patch) | |
| tree | 0a971c86114656ec4e39f7789d9faeb70432c36a /drivers/gpu/drm/i915/i915_gem_execbuffer.c | |
| parent | ea01d31a07ae182028d2398380948f5a4ee09953 (diff) | |
| parent | 50260924afd4b745bfb6e5f1caee381a1875fc31 (diff) | |
Merge branch 'clk/mxs' of git://git.linaro.org/people/shawnguo/linux-2.6 into next/clock
Shawn Guo <shawn.guo@linaro.org> writes:
mxs common clk porting for v3.5. It depends on the following two branches.
[1] git://git.linaro.org/people/mturquette/linux.git clk-next
[2] http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-arm.git clkdev
As the mxs device tree conversion will constantly touch clock files,
to save the conflicts, the updated mxs/dt branch coming later will
based on this pull-request.
* 'clk/mxs' of git://git.linaro.org/people/shawnguo/linux-2.6:
ARM: mxs: remove now unused timer_clk argument from mxs_timer_init
ARM: mxs: remove old clock support
ARM: mxs: switch to common clk framework
ARM: mxs: change the lookup name for fec phy clock
ARM: mxs: request clock for timer
clk: mxs: add clock support for imx28
clk: mxs: add clock support for imx23
clk: mxs: add mxs specific clocks
Includes an update to Linux 3.4-rc6
Conflicts:
drivers/clk/Makefile
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem_execbuffer.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem_execbuffer.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c index f51a696486c..de431942ded 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -1133,6 +1133,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, return -EINVAL; } + if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) { + DRM_DEBUG("execbuf with %u cliprects\n", + args->num_cliprects); + return -EINVAL; + } cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects), GFP_KERNEL); if (cliprects == NULL) { @@ -1404,7 +1409,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, struct drm_i915_gem_exec_object2 *exec2_list = NULL; int ret; - if (args->buffer_count < 1) { + if (args->buffer_count < 1 || + args->buffer_count > UINT_MAX / sizeof(*exec2_list)) { DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count); return -EINVAL; } |