linux/drivers/gpu/drm, branch v2.6.27.55

drm: stop information leak of old kernel stack.

2010-08-26T23:40:13Z

commit b9f0aee83335db1f3915f4e42a5e21b351740afd upstream. non-critical issue, CVE-2010-2803 Userspace controls the amount of memory to be allocate, so it can get the ioctl to allocate more memory than the kernel uses, and get access to kernel stack. This can only be done for processes authenticated to the X server for DRI access, and if the user has DRI access. Fix is to just memset the data to 0 if the user doesn't copy into it in the first place. Reported-by: Kees Cook Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

drm/r128: Add test for initialisation to all ioctls that require it

2010-04-01T22:52:24Z

commit 7dc482dfeeeefcfd000d4271c4626937406756d7 upstream. Almost all r128's private ioctls require that the CCE state has already been initialised. However, most do not test that this has been done, and will proceed to dereference a null pointer. This may result in a security vulnerability, since some ioctls are unprivileged. This adds a macro for the common initialisation test and changes all ioctl implementations that require prior initialisation to use that macro. Also, r128_do_init_cce() does not test that the CCE state has not been initialised already. Repeated initialisation may lead to a crash or resource leak. This adds that test. Signed-off-by: Ben Hutchings Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

drm/i915: add support for G41 chipset

2009-05-08T21:54:33Z

commit 72021788678523047161e97b3dfed695e802a5fd upstream. This had been delayed for some time due to failure to work on the one piece of G41 hardware we had, and lack of success reports from anybody else. Current hardware appears to be OK. Signed-off-by: Zhenyu Wang [anholt: hand-applied due to conflicts with IGD patches] Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman

drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)

2008-10-22T21:21:29Z

commit 4b40893918203ee1a1f6a114316c2a19c072e9bd upstream Olaf Kirch noticed that the i915_set_status_page() function of the i915 kernel driver calls ioremap with an address offset that is supplied by userspace via ioctl. The function zeroes the mapped memory via memset and tells the hardware about the address. Turns out that access to that ioctl is not restricted to root so users could probably exploit that to do nasty things. We haven't tried to write actual exploit code though. It only affects the Intel G33 series and newer. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

drm/radeon: downgrade debug message from info to debug.

2008-08-31T22:51:52Z

If this triggers its bad, however some machines seem to have been triggering it for ages and we didn't know until we added the debug. So downgrade the debug now so people don't call this a regression. Signed-off-by: Dave Airlie

Merge branch 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

2008-08-27T21:28:45Z

* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: don't set the signal blocker on the master process. drm: don't call the vblank tasklet with irqs disabled. r300: Fix cliprect emit drm/radeon: r300_cmdbuf: Always emit INDX_BUFFER immediately after DRAW_INDEX radeon: fix some hard lockups on r3/4/500s

drm: don't set the signal blocker on the master process.

2008-08-24T20:35:33Z

There is a problem with debugging the X server and gdb crashes in the xkb startup code. This avoids the problem by allowing the master process to get signals. It should be safe as the signal blocker is mainly so that you can Ctrl-Z a 3D application without locking up the whole box. Ctrl-Z the X server isn't something many people do. Signed-off-by: Dave Airlie

drm: don't call the vblank tasklet with irqs disabled.

2008-08-24T20:35:21Z

If a specific tasklet shares data with irq context, it needs to take a private irq-blocking spinlock within the tasklet itself. Signed-off-by: Dave Airlie

r300: Fix cliprect emit

2008-08-24T20:35:12Z

This makes our handling of cliprects sane. drm_clip_rect always has exclusiv bottom-right corners, but the hardware expects inclusive bottom-right corner so we adjust this here. This complements Michel Daenzer's commit 57aea290e1e0a26d1e74df6cff777eb9f03 to Mesa. See also http://bugs.freedesktop.org/show_bug.cgi?id=16123 Signed-off-by: Dave Airlie

drm/radeon: r300_cmdbuf: Always emit INDX_BUFFER immediately after DRAW_INDEX

2008-08-24T20:35:05Z

DRAW_INDEX writes a vertex count to VAP_VF_CNTL. Docs say that behaviour is undefined (i.e. lockups happen) when this write is not followed by the right number of vertex indices. Thus we used to do the wrong thing when drawing across many cliprects was necessary, because we emitted a sequence DRAW_INDEX, DRAW_INDEX, INDX_BUFFER, INDX_BUFFER instead of DRAW_INDEX, INDX_BUFFER, DRAW_INDEX, INDX_BUFFER The latter is what we're doing now and which ought to be correct. Signed-off-by: Dave Airlie