Gerd Hoffmann b78bd121b4 drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command ...

commit 34855706c3 upstream.

This avoids integer overflows on 32bit machines when calculating
reloc_info size, as reported by Alan Cox.

Cc: gnomes@lxorguk.ukuu.org.uk
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-03-03 15:07:23 -08:00

..

Kconfig

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2014-01-22 21:21:55 -08:00

Makefile

drm/qxl: enables gem prime helpers for qxl using dummy driver callbacks

2014-09-03 15:36:52 +10:00

qxl_cmd.c

drm/qxl: Remove format string errors

2015-06-05 11:00:51 +10:00

qxl_debugfs.c

drm/qxl: Remove release_lock stupidity

2014-09-03 17:09:11 +02:00

qxl_dev.h

…

qxl_display.c

drm/qxl: avoid buffer reservation in qxl_crtc_page_flip

2015-10-07 15:33:06 +10:00

qxl_draw.c

qxl: convert qxl driver to proper use for reservations

2013-07-24 11:58:10 +10:00

qxl_drv.c

drm/irq: Use unsigned int pipe in public API

2015-10-06 12:57:47 +02:00

qxl_drv.h

drm/qxl: validate monitors config modes

2015-09-11 10:51:33 +10:00

qxl_dumb.c

drm/gem: create drm_gem_dumb_destroy

2013-08-07 09:59:24 +10:00

qxl_fb.c

drm/qxl: fix framebuffer dirty rectangle tracking.

2015-10-07 15:31:45 +10:00

qxl_gem.c

drm/qxl: Move main reference counter to GEM object instead of TTM ones

2015-06-05 11:00:51 +10:00

qxl_image.c

qxl: convert qxl driver to proper use for reservations

2013-07-24 11:58:10 +10:00

qxl_ioctl.c

drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command

2016-03-03 15:07:23 -08:00

qxl_irq.c

drm/qxl: return IRQ_NONE if it was not our irq

2014-07-17 08:08:06 +10:00

qxl_kms.c

drm/qxl: simple crtc page flipping emulated using buffer copy

2014-09-03 15:35:27 +10:00

qxl_object.c

drm/qxl: Don't take dev->struct_mutex in bo_force_delete

2015-08-11 12:04:16 +02:00

qxl_object.h

drm/ttm: flip the switch, and convert to dma_fence

2014-09-02 16:41:50 +02:00

qxl_prime.c

drm: Pass dma-buf as argument to gem_prime_import_sg_table

2014-09-30 14:04:00 +02:00

qxl_release.c

drm/qxl: avoid dependency lock

2015-10-07 15:33:45 +10:00

qxl_ttm.c

drm/<ttm-based-drivers>: Don't call drm_mmap

2014-09-24 11:42:51 +10:00