diff options
| author | David S. Miller <davem@davemloft.net> | 2011-06-20 22:29:08 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-06-20 22:29:08 -0700 |
| commit | 9f6ec8d697c08963d83880ccd35c13c5ace716ea (patch) | |
| tree | ad8d93cf6fcdd09b86ade09f5fcbbc66cdb1cca2 /drivers/gpu/drm/radeon/r100_track.h | |
| parent | 4aa3a715551c93eda32d79bd52042ce500bd5383 (diff) | |
| parent | 56299378726d5f2ba8d3c8cbbd13cb280ba45e4f (diff) | |
| download | blackbird-op-linux-9f6ec8d697c08963d83880ccd35c13c5ace716ea.tar.gz blackbird-op-linux-9f6ec8d697c08963d83880ccd35c13c5ace716ea.zip | |
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Conflicts:
drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
drivers/net/wireless/rtlwifi/pci.c
net/netfilter/ipvs/ip_vs_core.c
Diffstat (limited to 'drivers/gpu/drm/radeon/r100_track.h')
| -rw-r--r-- | drivers/gpu/drm/radeon/r100_track.h | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h index 2fef9de7f363..686f9dc5d4bd 100644 --- a/drivers/gpu/drm/radeon/r100_track.h +++ b/drivers/gpu/drm/radeon/r100_track.h @@ -63,7 +63,7 @@ struct r100_cs_track { unsigned num_arrays; unsigned max_indx; unsigned color_channel_mask; - struct r100_cs_track_array arrays[11]; + struct r100_cs_track_array arrays[16]; struct r100_cs_track_cb cb[R300_MAX_CB]; struct r100_cs_track_cb zb; struct r100_cs_track_cb aa; @@ -146,6 +146,12 @@ static inline int r100_packet3_load_vbpntr(struct radeon_cs_parser *p, ib = p->ib->ptr; track = (struct r100_cs_track *)p->track; c = radeon_get_ib_value(p, idx++) & 0x1F; + if (c > 16) { + DRM_ERROR("Only 16 vertex buffers are allowed %d\n", + pkt->opcode); + r100_cs_dump_packet(p, pkt); + return -EINVAL; + } track->num_arrays = c; for (i = 0; i < (c - 1); i+=2, idx+=3) { r = r100_cs_packet_next_reloc(p, &reloc); |
