diff options
| author | Ingo Molnar <mingo@elte.hu> | 2011-07-01 10:28:42 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2011-07-01 10:28:46 +0200 |
| commit | 10e6962765f8213941eaa1cbb9de425ff0689e2e (patch) | |
| tree | c277e4ac5b2b7156152454578c39e90da5127dd8 /drivers/gpu/drm/radeon/r100_track.h | |
| parent | af07ce3e77d3b24ab1d71fcc5833d41800f23b2b (diff) | |
| parent | b0af8dfdd67699e25083478c63eedef2e72ebd85 (diff) | |
Merge commit 'v3.0-rc5' into perf/core
Merge reason: Pick up the latest fixes.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Diffstat (limited to 'drivers/gpu/drm/radeon/r100_track.h')
| -rw-r--r-- | drivers/gpu/drm/radeon/r100_track.h | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h index 2fef9de7f363..686f9dc5d4bd 100644 --- a/drivers/gpu/drm/radeon/r100_track.h +++ b/drivers/gpu/drm/radeon/r100_track.h @@ -63,7 +63,7 @@ struct r100_cs_track { unsigned num_arrays; unsigned max_indx; unsigned color_channel_mask; - struct r100_cs_track_array arrays[11]; + struct r100_cs_track_array arrays[16]; struct r100_cs_track_cb cb[R300_MAX_CB]; struct r100_cs_track_cb zb; struct r100_cs_track_cb aa; @@ -146,6 +146,12 @@ static inline int r100_packet3_load_vbpntr(struct radeon_cs_parser *p, ib = p->ib->ptr; track = (struct r100_cs_track *)p->track; c = radeon_get_ib_value(p, idx++) & 0x1F; + if (c > 16) { + DRM_ERROR("Only 16 vertex buffers are allowed %d\n", + pkt->opcode); + r100_cs_dump_packet(p, pkt); + return -EINVAL; + } track->num_arrays = c; for (i = 0; i < (c - 1); i+=2, idx+=3) { r = r100_cs_packet_next_reloc(p, &reloc); |