| From 1922756124ddd53846877416d92ba4a802bc658f Mon Sep 17 00:00:00 2001 |
| From: Dave Airlie <airlied@redhat.com> |
| Date: Thu, 24 Feb 2011 08:35:06 +1000 |
| Subject: drm: fix unsigned vs signed comparison issue in modeset ctl ioctl. |
| |
| From: Dave Airlie <airlied@redhat.com> |
| |
| commit 1922756124ddd53846877416d92ba4a802bc658f upstream. |
| |
| This fixes CVE-2011-1013. |
| |
| Reported-by: Matthiew Herrb (OpenBSD X.org team) |
| Signed-off-by: Dave Airlie <airlied@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/gpu/drm/drm_irq.c | 3 ++- |
| include/drm/drmP.h | 2 +- |
| 2 files changed, 3 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/gpu/drm/drm_irq.c |
| +++ b/drivers/gpu/drm/drm_irq.c |
| @@ -540,7 +540,8 @@ int drm_modeset_ctl(struct drm_device *d |
| struct drm_file *file_priv) |
| { |
| struct drm_modeset_ctl *modeset = data; |
| - int crtc, ret = 0; |
| + int ret = 0; |
| + unsigned int crtc; |
| |
| /* If drm_vblank_init() hasn't been called yet, just no-op */ |
| if (!dev->num_crtcs) |
| --- a/include/drm/drmP.h |
| +++ b/include/drm/drmP.h |
| @@ -1016,7 +1016,7 @@ struct drm_device { |
| struct pci_controller *hose; |
| #endif |
| struct drm_sg_mem *sg; /**< Scatter gather memory */ |
| - int num_crtcs; /**< Number of CRTCs on this device */ |
| + unsigned int num_crtcs; /**< Number of CRTCs on this device */ |
| void *dev_private; /**< device private data */ |
| void *mm_private; |
| struct address_space *dev_mapping; |
