kernel/git/stable/linux-stable.git/drivers/char/drm, branch linux-2.6.23.y

vm audit: add VM_DONTEXPAND to mmap for drivers that need it (CVE-2008-0007)

2008-02-08T20:01:45+00:00

Drivers that register a ->fault handler, but do not range-check the offset argument, must set VM_DONTEXPAND in the vm_flags in order to prevent an expanding mremap from overflowing the resource. I've audited the tree and attempted to fix these problems (usually by adding VM_DONTEXPAND where it is not obvious). Signed-off-by: Nick Piggin Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

radeon: set the address to access the GART table on the CPU side correctly

2007-11-16T17:30:24+00:00

Upstream as 7fc86860cf73e060ab8ed9763010dfe5b5389b1c This code relied on the CPU and GPU address for the aperture being the same, On some r5xx hardware I was playing with I noticed that this isn't always true. This fixes issues seen on some r400 cards. (bugs.freedesktop.org 9957) Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

i915: fix vbl swap allocation size.

2007-11-16T17:30:19+00:00

This is upstream as 54583bf4efda79388fc13163e35c016c8bc5de81 Oops... Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

i915: make vbl interrupts work properly on i965g/gm hw.

2007-09-28T02:47:28+00:00

This code is ported from the DRM git tree and allows the vblank interrupts to function on the i965 hw. It also requires a change in Mesa's 965 driver to actually use them. [ Without this patch, my 965GM drops vblank interrupts - Jesse ] Signed-off-by: Dave Airlie Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds

Merge branch 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

2007-08-25T15:01:06+00:00

* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: ioremap return value checks drm/via: Fix dmablit when blit queue is full drm_rmmap_ioctl(): remove dead code

drm: ioremap return value checks

2007-08-25T08:17:49+00:00

Signed-off-by: Scott Thompson hushmail.com> Signed-off-by: Dave Airlie

drm/i915: Fix i965 secured batchbuffer usage

2007-08-07T00:46:23+00:00

This 965G and above chipsets moved the batch buffer non-secure bits to another place. This means that previous drm's allowed in-secure batchbuffers to be submitted to the hardware from non-privileged users who are logged into X and and have access to direct rendering. Signed-off-by: Dave Airlie Signed-off-by: Linus Torvalds

drm/via: Fix dmablit when blit queue is full

2007-07-23T08:32:01+00:00

fd.o bug 11542 Acked-by: Thomas Hellstrom Signed-off-by: Dave Airlie

drm_rmmap_ioctl(): remove dead code

2007-07-23T08:29:41+00:00

This patch removes some obviously dead code spotted by the Coverity checker. Signed-off-by: Adrian Bunk Signed-off-by: Dave Airlie

some kmalloc/memset ->kzalloc (tree wide)

2007-07-19T17:04:50+00:00

Transform some calls to kmalloc/memset to a single kzalloc (or kcalloc). Here is a short excerpt of the semantic patch performing this transformation: @@ type T2; expression x; identifier f,fld; expression E; expression E1,E2; expression e1,e2,e3,y; statement S; @@ x = - kmalloc + kzalloc (E1,E2) ... when != \(x->fld=E;\|y=f(...,x,...);\|f(...,x,...);\|x=E;\|while(...) S\|for(e1;e2;e3) S\) - memset((T2)x,0,E1); @@ expression E1,E2,E3; @@ - kzalloc(E1 * E2,E3) + kcalloc(E1,E2,E3) [akpm@linux-foundation.org: get kcalloc args the right way around] Signed-off-by: Yoann Padioleau Cc: Richard Henderson Cc: Ivan Kokshaysky Acked-by: Russell King Cc: Bryan Wu Acked-by: Jiri Slaby Cc: Dave Airlie Acked-by: Roland Dreier Cc: Jiri Kosina Acked-by: Dmitry Torokhov Cc: Benjamin Herrenschmidt Acked-by: Mauro Carvalho Chehab Acked-by: Pierre Ossman Cc: Jeff Garzik Cc: "David S. Miller" Acked-by: Greg KH Cc: James Bottomley Cc: "Antonino A. Daplas" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds