| From 7eb3905d05ba3fd3782bd17cefa40ab8b173ddc3 Mon Sep 17 00:00:00 2001 |
| From: Dave Airlie <airlied@redhat.com> |
| Date: Thu, 24 Feb 2011 08:35:06 +1000 |
| Subject: [PATCH] drm: fix unsigned vs signed comparison issue in modeset ctl |
| ioctl. |
| |
| commit 1922756124ddd53846877416d92ba4a802bc658f upstream. |
| |
| This fixes CVE-2011-1013. |
| |
| Reported-by: Matthiew Herrb (OpenBSD X.org team) |
| Signed-off-by: Dave Airlie <airlied@redhat.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c |
| index a263b70..0ddd109 100644 |
| --- a/drivers/gpu/drm/drm_irq.c |
| +++ b/drivers/gpu/drm/drm_irq.c |
| @@ -545,7 +545,8 @@ int drm_modeset_ctl(struct drm_device *dev, void *data, |
| struct drm_file *file_priv) |
| { |
| struct drm_modeset_ctl *modeset = data; |
| - int crtc, ret = 0; |
| + int ret = 0; |
| + unsigned int crtc; |
| |
| /* If drm_vblank_init() hasn't been called yet, just no-op */ |
| if (!dev->num_crtcs) |
| diff --git a/include/drm/drmP.h b/include/drm/drmP.h |
| index 2f3b3a0..b447a35 100644 |
| --- a/include/drm/drmP.h |
| +++ b/include/drm/drmP.h |
| @@ -1022,7 +1022,7 @@ struct drm_device { |
| struct pci_controller *hose; |
| #endif |
| struct drm_sg_mem *sg; /**< Scatter gather memory */ |
| - int num_crtcs; /**< Number of CRTCs on this device */ |
| + unsigned int num_crtcs; /**< Number of CRTCs on this device */ |
| void *dev_private; /**< device private data */ |
| void *mm_private; |
| struct address_space *dev_mapping; |
| -- |
| 1.7.4.4 |
| |