Merge remote-tracking branch 'airlied/drm-core-next' into drm-intel-next-queued

Backmerge of drm-next to resolve a few ugly conflicts and to get a few
fixes from 3.4-rc6 (which drm-next has already merged). Note that this
merge also restricts the stencil cache lra evict policy workaround to
snb (as it should) - I had to frob the code anyway because the
CM0_MASK_SHIFT define died in the masked bit cleanups.

We need the backmerge to get Paulo Zanoni's infoframe regression fix
for gm45 - further bugfixes from him touch the same area and would
needlessly conflict.

Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

1 files changed, 8 insertions, 1 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index a46ed26464f4..206b9bbe6979 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1121,6 +1121,12 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                         return -EINVAL;
                 }
 
+                if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
+                        DRM_DEBUG("execbuf with %u cliprects\n",
+                                  args->num_cliprects);
+                        return -EINVAL;
+                }
+
                 cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
                                     GFP_KERNEL);
                 if (cliprects == NULL) {
@@ -1393,7 +1399,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
         struct drm_i915_gem_exec_object2 *exec2_list = NULL;
         int ret;
 
-        if (args->buffer_count < 1) {
+        if (args->buffer_count < 1 ||
+            args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
                 DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count);
                 return -EINVAL;
         }