Merge tag 'vt8500/pinctrl' of git://server.prisktech.co.nz/git/linuxwmt into next/drivers

From Tony Prisk <linux@prisktech.co.nz>:

arm: vt8500: Add pinctrl driver for arch-vt8500

This series adds support for the pinctrl/gpio module on all arch-vt8500
supported SoCs.

As part of the review process, some tidy up is also done to
drivers/of/base.c to remove some code that is being constantly duplicated.

Also, a patch for the bcm2835 pinctrl driver is included to take advantage
of the new of/base.c code.

* tag 'vt8500/pinctrl' of git://server.prisktech.co.nz/git/linuxwmt: (606 commits)
  pinctrl: bcm2835: make use of of_property_read_u32_index()
  gpio: vt8500: Remove arch-vt8500 gpio driver
  arm: vt8500: Remove gpio devicetree nodes
  arm: dts: vt8500: Update Wondermedia SoC dtsi files for pinctrl driver
  pinctrl: gpio: vt8500: Add pincontrol driver for arch-vt8500
  arm: vt8500: Increase available GPIOs on arch-vt8500
  of: Remove duplicated code for validating property and value
  of: Add support for reading a u32 from a multi-value property.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

1 files changed, 8 insertions, 3 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 2f2daebd0ee..3b11ab0fbc9 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -732,6 +732,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
 		   int count)
 {
 	int i;
+	int relocs_total = 0;
+	int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
 
 	for (i = 0; i < count; i++) {
 		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
@@ -740,10 +742,13 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
 		if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS)
 			return -EINVAL;
 
-		/* First check for malicious input causing overflow */
-		if (exec[i].relocation_count >
-		    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
+		/* First check for malicious input causing overflow in
+		 * the worst case where we need to allocate the entire
+		 * relocation tree as a single array.
+		 */
+		if (exec[i].relocation_count > relocs_max - relocs_total)
 			return -EINVAL;
+		relocs_total += exec[i].relocation_count;
 
 		length = exec[i].relocation_count *
 			sizeof(struct drm_i915_gem_relocation_entry);