linux-toradex.git/include/drm, branch v2.6.34.15 Linux kernel for Apalis and Colibri modules drm: integer overflow in drm_mode_dirtyfb_ioctl() 2012-08-17T19:34:59+00:00 Xi Wang xi.wang@gmail.com 2011-11-23T06:12:01+00:00 2d5bea3e719eb7dc957f168155337578acded206 commit a5cd335165e31db9dbab636fd29895d41da55dd2 upstream. There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if userspace passes in a large num_clips. The call to kmalloc would allocate a small buffer, and the call to fb->funcs->dirty may result in a memory corruption. Reported-by: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> 
commit a5cd335165e31db9dbab636fd29895d41da55dd2 upstream.

There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.

Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
drm/radeon: remove 0x4243 pci id 2011-06-26T16:46:36+00:00 Alex Deucher alexdeucher@gmail.com 2011-02-02T00:06:46+00:00 ed71260f8973623e273cb827ba64c78db5fe9cb9 commit 63a507800c8aca5a1891d598ae13f829346e8e39 upstream. 0x4243 is a PCI bridge, not a GPU. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=33815 Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> 
commit 63a507800c8aca5a1891d598ae13f829346e8e39 upstream.

0x4243 is a PCI bridge, not a GPU.

Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=33815

Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
drm: fix unsigned vs signed comparison issue in modeset ctl ioctl. 2011-04-17T20:16:15+00:00 Dave Airlie airlied@redhat.com 2011-02-23T22:35:06+00:00 4507b718182f5f0e8fbd52fd29f4acbf3acb68f8 commit 1922756124ddd53846877416d92ba4a802bc658f upstream. This fixes CVE-2011-1013. Reported-by: Matthiew Herrb (OpenBSD X.org team) Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> 
commit 1922756124ddd53846877416d92ba4a802bc658f upstream.

This fixes CVE-2011-1013.

Reported-by: Matthiew Herrb (OpenBSD X.org team)
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
drm/radeon: fix PCI ID 5657 to be an RV410 2011-01-06T23:08:12+00:00 Dave Airlie airlied@redhat.com 2010-09-25T07:45:50+00:00 78528b972d7d73b221ba5a404bab65c0522be697 commit f459ffbdfd04edb4a8ce6eea33170eb057a5e695 upstream. fixes https://bugzilla.kernel.org/show_bug.cgi?id=19012 cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> 
commit f459ffbdfd04edb4a8ce6eea33170eb057a5e695 upstream.

fixes https://bugzilla.kernel.org/show_bug.cgi?id=19012

cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
drm/radeon: add new pci ids 2010-08-10T17:54:14+00:00 Alex Deucher alexdeucher@gmail.com 2010-08-04T15:40:00+00:00 41673b54bd93691b28c15a12f708672bd650f8e4 commit 1297c05a8dfb568c689f057d51a65eebe5ddc86f upstream. New evergreen and r7xx ids. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 1297c05a8dfb568c689f057d51a65eebe5ddc86f upstream.

New evergreen and r7xx ids.

Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 2010-05-07T21:02:01+00:00 Linus Torvalds torvalds@linux-foundation.org 2010-05-07T21:02:01+00:00 e33b3e7567f8636c61e79ff1da5ff9a6cf6562c7 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/ttm: Remove the ttm_bo_block_reservation() function. drm/ttm: Remove some leftover debug messages. drm/radeon: async event synchronization for drmWaitVblank 
* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm/ttm: Remove the ttm_bo_block_reservation() function.
  drm/ttm: Remove some leftover debug messages.
  drm/radeon: async event synchronization for drmWaitVblank
drm/ttm: Remove the ttm_bo_block_reservation() function. 2010-05-06T23:21:28+00:00 Thomas Hellstrom thellstrom@vmware.com 2010-04-28T09:33:25+00:00 8cfe92d683a0041ac8e016a0b0a487c99a78f6c1 It's unused and buggy in its current form, since it can place a bo in the reserved state without removing it from lru lists. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com> 
It's unused and buggy in its current form, since it can place a bo
in the reserved state without removing it from lru lists.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 2010-04-19T14:27:06+00:00 Linus Torvalds torvalds@linux-foundation.org 2010-04-19T14:27:06+00:00 73c6c7fbb74d07a80fee41ce4ca3976547519e42 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: add FireMV 2400 PCI ID. drm/radeon/kms: allow R500 regs VAP_ALT_NUM_VERTICES and VAP_INDEX_OFFSET drivers/gpu/radeon: Add MSPOS regs to safe list. drm/radeon/kms: disable the tv encoder when tv/cv is not in use drm/radeon/kms: adjust pll settings for tv drm/radeon/kms: fix tv dac conflict resolver drm/radeon/kms/evergreen: don't enable hdmi audio stuff drm/radeon/kms/atom: fix dual-link DVI on DCE3.2/4.0 drm/radeon/kms: fix rs600 tlb flush drm/radeon/kms: print GPU family and device id when loading drm/radeon/kms: fix calculation of mipmapped 3D texture sizes drm/radeon/kms: only change mode when coherent value changes. drm/radeon/kms: more atom parser fixes (v2) 
* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm/radeon/kms: add FireMV 2400 PCI ID.
  drm/radeon/kms: allow R500 regs VAP_ALT_NUM_VERTICES and VAP_INDEX_OFFSET
  drivers/gpu/radeon: Add MSPOS regs to safe list.
  drm/radeon/kms: disable the tv encoder when tv/cv is not in use
  drm/radeon/kms: adjust pll settings for tv
  drm/radeon/kms: fix tv dac conflict resolver
  drm/radeon/kms/evergreen: don't enable hdmi audio stuff
  drm/radeon/kms/atom: fix dual-link DVI on DCE3.2/4.0
  drm/radeon/kms: fix rs600 tlb flush
  drm/radeon/kms: print GPU family and device id when loading
  drm/radeon/kms: fix calculation of mipmapped 3D texture sizes
  drm/radeon/kms: only change mode when coherent value changes.
  drm/radeon/kms: more atom parser fixes (v2)
drm/radeon/kms: add FireMV 2400 PCI ID. 2010-04-19T08:53:10+00:00 Dave Airlie airlied@redhat.com 2010-04-19T07:54:31+00:00 79b9517a33a283c5d9db875c263670ed1e055f7e This is an M24/X600 chip. From RH# 581927 cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> 
This is an M24/X600 chip.

From RH# 581927

cc: stable@kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Merge branch 'master' into export-slabh 2010-04-05T02:37:28+00:00 Tejun Heo tj@kernel.org 2010-04-05T02:37:28+00:00 336f5899d287f06d8329e208fc14ce50f7ec9698