1. 21 Apr, 2011 1 commit
    • Vasiliy Kulikov's avatar
      agp: fix OOM and buffer overflow · b522f021
      Vasiliy Kulikov authored
      page_count is copied from userspace.  agp_allocate_memory() tries to
      check whether this number is too big, but doesn't take into account the
      wrap case.  Also agp_create_user_memory() doesn't check whether
      alloc_size is calculated from num_agp_pages variable without overflow.
      This may lead to allocation of too small buffer with following buffer
      overflow.
      
      Another problem in agp code is not addressed in the patch - kernel memory
      exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls).  It is not checked
      whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
      Each allocation is limited to 16KB, though, there is no per-process limit.
      This might lead to OOM situation, which is not even solved in case of the
      caller death by OOM killer - the memory is allocated for another (faked) process.
      Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      b522f021
  2. 20 Apr, 2011 1 commit
  3. 19 Apr, 2011 8 commits
  4. 14 Apr, 2011 3 commits
  5. 12 Apr, 2011 8 commits
  6. 11 Apr, 2011 1 commit
    • Dave Airlie's avatar
      Merge remote branch 'nouveau/drm-nouveau-fixes' of /ssd/git/drm-nouveau-next into drm-fixes · d85023a3
      Dave Airlie authored
      * 'nouveau/drm-nouveau-fixes' of /ssd/git/drm-nouveau-next:
        drm/nvc0: improve vm flush function
        drm/nv50-nvc0: remove some code that doesn't belong here
        drm/nv50: use "nv86" tlb flush method on everything except 0x50/0xac
        drm/nouveau: quirk for XFX GT-240X-YA
        drm/nv50-nvc0: work around an evo channel hang that some people see
        drm/nouveau: implement init table opcode 0x5c
        drm/nouveau: fix oops on unload with disabled LVDS panel
        nv30: Fix parsing of perf table
        drm/nouveau: correct memtiming table parsing for nv4x
      d85023a3
  7. 09 Apr, 2011 5 commits
  8. 08 Apr, 2011 4 commits
  9. 07 Apr, 2011 9 commits