[PATCH] DRM: drm_stub_open() range checking
Linux Kernel Mailing List <[email protected]> Wed, 15 Mar 2006 16:59:25 GMT
| Newsgroups | gmane.linux.kernel.commits.2-4 |
|---|---|
| Message-ID | <[email protected]> |
commit 5dceef59f2919d7396853e4264636e3bd55f85e7 tree 1c3fa0960c0b546ae824eeed12402bffd55e21d7 parent 16496704f59962e49790d49dd07e00e6e5215e4f author Marin Mitov <[email protected]> Sun, 05 Mar 2006 18:30:23 +0200 committer Marcelo Tosatti <[email protected]> Sun, 12 Mar 2006 03:49:33 -0600 [PATCH] DRM: drm_stub_open() range checking This patch corrects a bug in drm driver by forcing its minor number in the limits of the allocated resources: DRM(stub_list)[DRM_STUB_MAXCARDS] 0<= minor < DRM_STUB_MAXCARDS. Manifestation: Xorg-6.9.0 SIGSEGFAULTs when the loading of dri module is enabled (direct rendering) Xorg-6.9.0 (and evidently not the previous versions) has defined DRM_MAX_MINOR as 255 (and Xorg-6.9.0 tries to open all of them) while in the kernel: DRM_STUB_MAXCARDS is defined as 16. drivers/char/drm/drm_stub.h | 1 + 1 files changed, 1 insertion(+) diff --git a/drivers/char/drm/drm_stub.h b/drivers/char/drm/drm_stub.h index 8ed33f6..90cde8d 100644 --- a/drivers/char/drm/drm_stub.h +++ b/drivers/char/drm/drm_stub.h @@ -52,6 +52,7 @@ static int DRM(stub_open)(struct inode * int err = -ENODEV; struct file_operations *old_fops; + if (minor < 0 || minor >=DRM_STUB_MAXCARDS) return -ENODEV; if (!DRM(stub_list) || !DRM(stub_list)[minor].fops) return -ENODEV; old_fops = filp->f_op; filp->f_op = fops_get(DRM(stub_list)[minor].fops);