leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
adde0f2339
linux/drivers/gpu/drm/i915
History
Dave Airlie 1b2f148963 drm: block userspace under allocating buffer and having drivers overwrite it (v2) 
With the current screwed but its ABI, ioctls for the drm, Linus pointed out that we could allow userspace to specify the allocation size, but we pass it to the driver which then uses it blindly to store a struct. Now if userspace specifies the allocation size as smaller than the driver needs, the driver can possibly overwrite memory.

This patch restructures the driver ioctls so we store the structure size we are expecting, and make sure we allocate at least that size. The copy from/to userspace are still restricted to the size the user specifies, this allows ioctl structs to grow on both sides of the equation.

Up until now we didn't really use the DRM_IOCTL defines in the kernel, so this cleans them up and adds them for nouveau.

v2:
fix nouveau pushbuf arg (thanks to Ben for pointing it out)

Reported-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2010-08-17 14:52:25 +10:00
..
dvo_ch7xxx.c drm/i915: Remove dead KMS encoder save/restore code. 2010-04-12 09:23:30 -07:00
dvo_ch7017.c drm/i915: Remove dead KMS encoder save/restore code. 2010-04-12 09:23:30 -07:00
dvo_ivch.c drm/i915: Remove dead KMS encoder save/restore code. 2010-04-12 09:23:30 -07:00
dvo_sil164.c drm/i915: Remove dead KMS encoder save/restore code. 2010-04-12 09:23:30 -07:00
dvo_tfp410.c drm/i915: Use RSEN instead of HTPLG for tfp410 monitor detection. 2010-06-04 16:39:59 -07:00
dvo.h drm/i915: Remove dead KMS encoder save/restore code. 2010-04-12 09:23:30 -07:00
i915_debugfs.c drm/i915: disable FBC when more than one pipe is active 2010-07-26 11:27:06 -07:00
i915_dma.c drm: block userspace under allocating buffer and having drivers overwrite it (v2) 2010-08-17 14:52:25 +10:00
i915_drv.c drm/i915: Refactor i915_gem_retire_requests() 2010-08-01 19:52:57 -07:00
i915_drv.h drm/i915: Repeat unbinding during free if interrupted (v6) 2010-08-01 19:53:24 -07:00
i915_gem_debug.c drm/i915: drop pointer to drm_gem_object 2010-04-20 13:23:14 +10:00
i915_gem_tiling.c drm: Use ENOENT consistently for the error return for an unmatched handle. 2010-08-10 10:46:55 +10:00
i915_gem.c drm: Use ENOENT consistently for the error return for an unmatched handle. 2010-08-10 10:46:55 +10:00
i915_ioc32.c drm: convert drm_ioctl to unlocked_ioctl 2009-12-18 11:22:31 +10:00
i915_irq.c drm/i915: Include instdone[1] in hangcheck 2010-08-01 19:03:46 -07:00
i915_mem.c drm: Remove memory debugging infrastructure. 2009-06-18 13:00:33 -07:00
i915_opregion.c drm/i915: set DIDL using the ACPI video output device _ADR method return. 2010-04-18 17:05:13 -07:00
i915_reg.h Merge remote branch 'origin/master' into drm-intel-next 2010-08-01 19:34:47 -07:00
i915_suspend.c drm/i915: Add frame buffer compression support on Ironlake mobile 2010-08-01 19:03:44 -07:00
i915_trace_points.c drm/i915: Add tracepoints 2009-09-23 01:05:21 +01:00
i915_trace.h drm/i915: add tracepoints for flip requests & completions 2010-07-02 14:04:14 +10:00
intel_bios.c drm/i915: Honor sync polarity from VBT panel timing descriptors 2010-06-01 10:19:37 -07:00
intel_bios.h drm/i915: parse eDP panel color depth from VBT block 2010-01-15 14:12:47 -08:00
intel_crt.c drm/i915: Fix CRT hotplug regression in 2.6.35-rc1 2010-07-01 15:35:57 -07:00
intel_display.c drm: expand gamma_set 2010-08-10 10:47:00 +10:00
intel_dp.c drm/i915: Validate the mode for eDP by using fixed panel size 2010-08-01 19:40:38 -07:00
intel_drv.h drm/i915: Unset cursor if out-of-bounds upon mode change (v4) 2010-08-01 19:58:28 -07:00
intel_dvo.c Merge remote branch 'anholt/drm-intel-next' of /home/airlied/kernel/drm-next into drm-core-next 2010-04-20 13:11:45 +10:00
intel_fb.c drm: Propagate error code from fb_create() 2010-08-10 10:46:51 +10:00
intel_hdmi.c drm/i915/hdmi: Set sync polarity based on actual mode 2010-08-01 19:38:08 -07:00
intel_i2c.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
intel_lvds.c drm/i915: Refactor panel fitting on the LVDS. (v2) 2010-08-01 19:35:17 -07:00
intel_modes.c Merge remote branch 'anholt/drm-intel-next' of /home/airlied/kernel/drm-next into drm-core-next 2010-04-20 13:11:45 +10:00
intel_overlay.c drm,io-mapping: Specify slot to use for atomic mappings 2010-08-05 08:48:53 +10:00
intel_ringbuffer.c drm/i915: Account for space on the ring buffer consumed whilst wrapping. 2010-07-01 15:28:08 -07:00
intel_ringbuffer.h drm/i915: introduce intel_ring_buffer structure (V2) 2010-05-26 13:24:49 -07:00
intel_sdvo_regs.h drm/i915: enable sdvo lvds scaling function. 2009-07-01 11:44:45 -07:00
intel_sdvo.c drm/i915/sdvo: Set sync polarity based on actual mode 2010-08-01 19:38:12 -07:00
intel_tv.c drm/i915: cleanup: use ARRAY_SIZE() 2010-08-01 19:03:46 -07:00
Makefile drm/i915: Move ringbuffer-related code to intel_ringbuffer.c. 2010-05-26 12:36:00 -07:00