UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

staging: xgifb: validate the mode against video memory size 

It's possible to select video mode that exceeds the available video
memory. This is potentially dangerous, fix by adding a check.

The patch fixes system hangs seen occasionally when playing random videos
with mplayer.

Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Aaro Koskinen 2012-09-12 00:44:37 +03:00 committed by Greg Kroah-Hartman
parent f325129ae9
commit a09f347c6c
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/staging/xgifb/XGI_main_26.c
View File

@ -329,6 +329,7 @@ static int XGIfb_validate_mode(struct xgifb_video_info *xgifb_info, int myindex)
{ {
u16 xres, yres; u16 xres, yres;
struct xgi_hw_device_info *hw_info = &xgifb_info->hw_info; struct xgi_hw_device_info *hw_info = &xgifb_info->hw_info;
unsigned long required_mem;
if (xgifb_info->chip == XG21) { if (xgifb_info->chip == XG21) {
if (xgifb_info->display2 == XGIFB_DISP_LCD) { if (xgifb_info->display2 == XGIFB_DISP_LCD) {
@ -345,13 +346,13 @@ static int XGIfb_validate_mode(struct xgifb_video_info *xgifb_info, int myindex)
} }
} }
return myindex; goto check_memory;
} }
/* FIXME: for now, all is valid on XG27 */ /* FIXME: for now, all is valid on XG27 */
if (xgifb_info->chip == XG27) if (xgifb_info->chip == XG27)
return myindex; goto check_memory;
if (!(XGIbios_mode[myindex].chipset & MD_XGI315)) if (!(XGIbios_mode[myindex].chipset & MD_XGI315))
return -1; return -1;
@ -539,6 +540,12 @@ static int XGIfb_validate_mode(struct xgifb_video_info *xgifb_info, int myindex)
case XGIFB_DISP_NONE: case XGIFB_DISP_NONE:
break; break;
} }
check_memory:
required_mem = XGIbios_mode[myindex].xres * XGIbios_mode[myindex].yres *
XGIbios_mode[myindex].bpp / 8;
if (required_mem > xgifb_info->video_size)
return -1;
return myindex; return myindex;
} }