- core: Fix regression in dev node offsets (Haneen)
- vc4: Fix memory leak on driver close (Eric) - dumb-buffers: Prevent overflow in DIV_ROUND_UP() (Dan) Cc: Haneen Mohammed <hamohammed.sa@gmail.com> Cc: Eric Anholt <eric@anholt.net> Cc: Dan Carpenter <dan.carpenter@oracle.com> -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEfxcpfMSgdnQMs+QqlvcN/ahKBwoFAlr8hJYACgkQlvcN/ahK Bwo/RAf9EbvVp9r9B0yAzChimHod4MSFNY0dqAGy84DbgQ1dJ6vhF0HeRoiVbTo8 1BrH8x212boMQHnVonIm9+XxW8pqX6ynTDEO4squTapLwgAZ06iP5tcnhpd6sawA zTQx91uYOfDYH1NeIDwnmvnCZuC8U+/RIak7AJx0AJrXJLEb52Brl9smrndovAtJ iYIryKF5tEMm5hzfv/Vna78oWcw1uPGjhxiL5gULCFsIqesTA8fS4+Kp8Opr38zb 9bMpBTYEkobcHEtXnGVjy8azvWn3QYkOQzi9oOfGV/XVD1w7HvGoNjg29WPte0m1 rap9ZDWj6iwRXPgZ1Faj6VDwPYm9kA== =H2nb -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2018-05-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes - core: Fix regression in dev node offsets (Haneen) - vc4: Fix memory leak on driver close (Eric) - dumb-buffers: Prevent overflow in DIV_ROUND_UP() (Dan) Cc: Haneen Mohammed <hamohammed.sa@gmail.com> Cc: Eric Anholt <eric@anholt.net> Cc: Dan Carpenter <dan.carpenter@oracle.com> * tag 'drm-misc-fixes-2018-05-16' of git://anongit.freedesktop.org/drm/drm-misc: drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl() drm/vc4: Fix leak of the file_priv that stored the perfmon. drm: Match sysfs name in link removal to link creation
This commit is contained in:
commit
3d3aa969cb
|
@ -716,7 +716,7 @@ static void remove_compat_control_link(struct drm_device *dev)
|
|||
if (!minor)
|
||||
return;
|
||||
|
||||
name = kasprintf(GFP_KERNEL, "controlD%d", minor->index);
|
||||
name = kasprintf(GFP_KERNEL, "controlD%d", minor->index + 64);
|
||||
if (!name)
|
||||
return;
|
||||
|
||||
|
|
|
@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev,
|
|||
return -EINVAL;
|
||||
|
||||
/* overflow checks for 32bit size calculations */
|
||||
/* NOTE: DIV_ROUND_UP() can overflow */
|
||||
if (args->bpp > U32_MAX - 8)
|
||||
return -EINVAL;
|
||||
cpp = DIV_ROUND_UP(args->bpp, 8);
|
||||
if (!cpp || cpp > 0xffffffffU / args->width)
|
||||
if (cpp > U32_MAX / args->width)
|
||||
return -EINVAL;
|
||||
stride = cpp * args->width;
|
||||
if (args->height > 0xffffffffU / stride)
|
||||
if (args->height > U32_MAX / stride)
|
||||
return -EINVAL;
|
||||
|
||||
/* test for wrap-around */
|
||||
|
|
|
@ -130,6 +130,7 @@ static void vc4_close(struct drm_device *dev, struct drm_file *file)
|
|||
struct vc4_file *vc4file = file->driver_priv;
|
||||
|
||||
vc4_perfmon_close_file(vc4file);
|
||||
kfree(vc4file);
|
||||
}
|
||||
|
||||
static const struct vm_operations_struct vc4_vm_ops = {
|
||||
|
|
Loading…
Reference in a new issue