kernel/git/stable/linux.git/drivers/char/drm, branch linux-2.6.25.y

drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)

2008-10-22T21:05:16+00:00

commit 4b40893918203ee1a1f6a114316c2a19c072e9bd upstream Olaf Kirch noticed that the i915_set_status_page() function of the i915 kernel driver calls ioremap with an address offset that is supplied by userspace via ioctl. The function zeroes the mapped memory via memset and tells the hardware about the address. Turns out that access to that ioctl is not restricted to root so users could probably exploit that to do nasty things. We haven't tried to write actual exploit code though. It only affects the Intel G33 series and newer. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman

DRM: enable bus mastering on i915 at resume time

2008-07-03T03:46:15+00:00

commit ea7b44c8e6baa1a4507f05ba2c0009ac21c3fe0b upstream On 9xx chips, bus mastering needs to be enabled at resume time for much of the chip to function. With this patch, vblank interrupts will work as expected on resume, along with other chip functions. Fixes kernel bugzilla #10844. Signed-off-by: Jie Luo Signed-off-by: Jesse Barnes Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

fix IS_I9XX macro in i915 DRM driver

2008-04-06T23:10:40+00:00

Now that we're mapping registers in the DRM driver at load time, the driver actually checks the PCI ID, so we need to make sure the macros have all the right bits (and longer term use the DRM headers as the sole copy of the PCI & register definitions). This patch adds 945GME support to the DRM headers, fixing a regression reported in http://bugzilla.kernel.org/show_bug.cgi?id=10395. Tested-by: Alexander Oltu Signed-off-by: Jesse Barnes Signed-off-by: Linus Torvalds

drm: fix for non-coherent DMA PowerPC

2008-03-29T21:57:57+00:00

This patch fixes bits of the DRM so to make the radeon DRI work on non-cache coherent PCI DMA variants of the PowerPC processors. It moves the few places that needs change to wrappers to that other architectures with similar issues can easily add their own changes to those wrappers, at least until we have more useful generic kernel API. Signed-off-by: Benjamin Herrenschmidt Cc: "David S. Miller" Cc: "Luck, Tony" Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie

drm: radeon: fix sparse integer as NULL pointer warnings in radeon_mem.c

2008-03-29T21:56:39+00:00

drivers/char/drm/radeon_mem.c:91:23: warning: Using plain integer as NULL pointer drivers/char/drm/radeon_mem.c:116:28: warning: Using plain integer as NULL pointer drivers/char/drm/radeon_mem.c:124:28: warning: Using plain integer as NULL pointer drivers/char/drm/radeon_mem.c:177:26: warning: Using plain integer as NULL pointer drivers/char/drm/radeon_mem.c:177:53: warning: Using plain integer as NULL pointer Signed-off-by: Harvey Harrison Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie

drm/i915: fix oops on agp=off

2008-03-29T21:53:58+00:00

From Kernel BZ 10289 - not sure why anyone would boot an intel with no agp but it shouldn't crash. Signed-off-by: Dave Airlie

drm/r300: fix bug in r300 userspace hardware wait emission

2008-03-29T21:51:49+00:00

This interface was originally designed wrong, confusing bit-fields and integers, major brown paper bag going back many years... But userspace only ever used 4 values so fix the interface for new users and fix the implementation to deal with the 4 values userspace has ever emitted (0x1, 0x2, 0x3, 0x6). Signed-off-by: Dave Airlie

drivers/char/drm/ati_pcigart.c: fix printk warning

2008-03-28T21:45:21+00:00

drivers/char/drm/ati_pcigart.c: In function 'drm_ati_pcigart_init': drivers/char/drm/ati_pcigart.c:125: warning: format '%08X' expects type 'unsigned int', but argument 3 has type 'dma_addr_t' Cc: Dave Airlie Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

drm/ati_pcigart: fix the PCIGART to use drm_pci to allocate GART table.

2008-03-17T00:24:24+00:00

This fixes a problem on 64-bit with 4GB with ATI RS690 chipsets. It makes sure the pcigart table is allocated in coherent memory for DMA operations. Signed-off-by: Dave Airlie

drm/radeon: fixup RV550 chip family

2008-03-17T00:22:12+00:00

This fixes up the RV550 chips which are based on RV515, not RV530. It also adds another RS690 PCI ID. Signed-off-by: Dave Airlie