Christian König a66477b0ef drm/ttm: fix out-of-bounds read in ttm_put_pages() v2 ... When ttm_put_pages() tries to figure out whether it's dealing with transparent hugepages, it just reads past the bounds of the pages array without a check. v2: simplify the test if enough pages are left in the array (Christian). Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Christian König <christian.koenig@amd.com> Fixes: 5c42c64f7d ("drm/ttm: fix the fix for huge compound pages") Cc: stable@vger.kernel.org Reviewed-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com> Reviewed-by: Huang Rui <ray.huang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>		2019-04-11 10:01:23 -05:00
..
Makefile	drm/ttm, drm/vmwgfx: Move the lock- and object functionality to the vmwgfx driver	2018-09-27 15:19:20 +02:00
ttm_agp_backend.c	Add SPDX idenitifier and clarify license	2018-05-15 13:44:27 -05:00
ttm_bo_manager.c	Add SPDX idenitifier and clarify license	2018-05-15 13:44:27 -05:00
ttm_bo_util.c	drm/ttm: fix LRU handling in ttm_buffer_object_transfer	2018-11-30 12:00:57 -05:00
ttm_bo_vm.c	drm/ttm: stop always moving BOs on the LRU on page fault	2019-01-25 16:15:34 -05:00
ttm_bo.c	drm/ttm: Remove ttm_bo_reference and ttm_bo_unref	2019-01-28 11:43:38 -05:00
ttm_execbuf_util.c	drm/ttm: allow reserving more than one shared slot v3	2018-12-07 17:53:44 -05:00
ttm_memory.c	drm/ttm: Fix bo_global and mem_global kfree error	2018-11-07 17:05:55 -05:00
ttm_module.c	Add SPDX idenitifier and clarify license	2018-05-15 13:44:27 -05:00
ttm_page_alloc_dma.c	drm/ttm: remove dead codes	2018-08-27 11:11:02 -05:00
ttm_page_alloc.c	drm/ttm: fix out-of-bounds read in ttm_put_pages() v2	2019-04-11 10:01:23 -05:00
ttm_tt.c	drm/ttm: clean up non-x86 definitions on ttm_tt	2018-08-01 17:23:56 -05:00