user/sven/linux.git/drivers/gpu/drm/vmwgfx, branch v3.2.22

drm/vmwgfx: Fix nasty write past alloced memory area

2012-06-10T13:41:55Z

commit 0824db38e515644f8d1bfd64adbd7cb2c6ea7c62 upstream. Signed-off-by: Thomas Hellstrom Reviewed-by: Jakob Bornecrantz Signed-off-by: Dave Airlie Signed-off-by: Ben Hutchings

vmwgfx: Fix assignment in vmw_framebuffer_create_handle

2012-02-03T17:22:08Z

commit bf9c05d5b6d19b3e4c9fe21047694e94f48db89b upstream. The assignment of handle in vmw_framebuffer_create_handle doesn't actually do anything useful and is incorrectly assigning an integer value to a pointer argument. It appears that this is a typo and should be dereferencing handle rather than assigning to it directly. This fixes a bug where an undefined handle value is potentially returned to user-space. Signed-off-by: Ryan Mallon Reviewed-by: Jakob Bornecrantz Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

vmwgfx: fix incorrect VRAM size check in vmw_kms_fb_create()

2011-12-22T12:31:02Z

Commit e133e737 didn't correctly fix the integer overflow issue. - unsigned int required_size; + u64 required_size; ... required_size = mode_cmd->pitch * mode_cmd->height; - if (unlikely(required_size > dev_priv->vram_size)) { + if (unlikely(required_size > (u64) dev_priv->vram_size)) { Note that both pitch and height are u32. Their product is still u32 and would overflow before being assigned to required_size. A correct way is to convert pitch and height to u64 before the multiplication. required_size = (u64)mode_cmd->pitch * (u64)mode_cmd->height; This patch calls the existing vmw_kms_validate_mode_vram() for validation. Signed-off-by: Xi Wang Reviewed-and-tested-by: Thomas Hellstrom Signed-off-by: Dave Airlie

vmwgfx: Clip cliprects against screen boundaries in present and dirty

2011-12-19T14:06:05Z