Commits · e75276adaca2394f0de45dc342cf88a882a1dfd9 · Kirill Smelkov / linux

08 Feb, 2005 1 commit
- Merge bk://drm.bkbits.net/drm-linus · e75276ad
  Linus Torvalds authored Feb 07, 2005
```
into ppc970.osdl.org:/home/torvalds/v2.6/linux
```
  e75276ad
09 Feb, 2005 3 commits

Merge starflyer.(none):/foo/airlied/bitkeeper/linux-2.5 · 7dcd6234
Dave Airlie authored Feb 09, 2005
```
into starflyer.(none):/foo/airlied/bitkeeper/drm-latest
```
7dcd6234

drm: fix race condition in radeon driver · 4b5d2381

Dave Airlie authored Feb 09, 2005

Close a race which could allow for privilege escalation by users with DRI
privileges on Radeon hardware. Essentially, a malicious program could submit
a packet containing an offset (possibly in main memory) to be rendered from/to,
while a separate thread switched that offset in userspace rapidly between a
valid value and an invalid one. radeon_check_and_fixup_offset() would pull the
offset in from user space, check it, and spit it back out to user space to be
copied in later by the emit code. It would sometimes catch the bad value, but
sometimes the malicious program could modify it after the check and get an
invalid offset rendered from/to.

Fix this by allocating a temporary buffer and copying the data in at once.
While here, make the cliprects stuff not do the VERIFYAREA_READ and
COPY_FROM_USER_UNCHECKED gymnastics, avoiding a lock order reversal on FreeBSD.
Performance impact is negligible -- no difference on r200 to ~1% improvement on
rv200 in quake3 tests (P4 1Ghz, demofour at 1024x768, n=4 or 5)

From: Eric Anholt <anholt@freebsd.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>

4b5d2381

Invalid bound check of driver defined ioctls in drm_ioctl · 149d5cef
Dave Airlie authored Feb 09, 2005
```
Bug fd.o 2489
Reporter: Aapo Tahkola <aet@rasterburn.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>
```
149d5cef

08 Feb, 2005 2 commits

[PATCH] NOMMU: Documentation of no-MMU mmap · e1920b53

David Howells authored Feb 07, 2005

The attached patch adds documentation for the behaviour of the no-MMU mmap.
Signed-Off-By: David Howells <dhowells@redhat.com>
Signed-Off-By: Linus Torvalds <torvalds@osdl.org>

e1920b53

[PATCH] NOMMU: Improved handling of get_unmapped_area() errors · d7c43720

David Howells authored Feb 07, 2005

The attached patch does two things:

 (1) We no longer check the return value of file->f_op->get_unmapped_area()
     unless we actually called it. We know addr is zero otherwise because
     we'd've given an error earlier if it wasn't.

 (2) If -ENOSYS was returned by that operation, then we assume we actually
     called a driver (such as the framebuffer driver) that might want to
     invoke the operation in a lower level driver (such as matroxfb) if one
     exists, and that it found that one didn't.

     We translate the -ENOSYS error into -ENODEV - the error we would have
     given if the operation was not supplied in the file ops.

     Doing this permits us an opportunity for arch_get_unmapped_area() or
     something else to be called if we want that to happen, particularly in
     the MMU case.
Signed-Off-By: David Howells <dhowells@redhat.com>
Signed-Off-By: Linus Torvalds <torvalds@osdl.org>

d7c43720

07 Feb, 2005 32 commits

Fix ATM copy-to-user usage. · ca323f21
Linus Torvalds authored Feb 07, 2005
```
More of the Guninski "copy_to_user() takes a size_t" series.
```
ca323f21