diff options
| author |   Andy Getzendanner <james.getzendanner@students.olin.edu> | 2010-02-11 14:04:48 +1000 |
|---|---|---|
| committer |   Dave Airlie <airlied@redhat.com> | 2010-02-11 14:04:48 +1000 |
| commit | 77c1ff3982c6b36961725dd19e872a1c07df7f3b (patch) | |
| tree | 679ddde451763655c6594ae18afa58fcfc7339b1 /drivers/gpu/drm/drm_gem.c | |
| parent | Merge branch 'drm-radeon-linus' of ../drm-next (diff) | |
| download | linux-dev-77c1ff3982c6b36961725dd19e872a1c07df7f3b.tar.xz linux-dev-77c1ff3982c6b36961725dd19e872a1c07df7f3b.zip | |
vgaarb: fix incorrect dereference of userspace pointer.
This patch corrects a userspace pointer dereference in the VGA arbiter
in 2.6.32.1.
copy_from_user() is used at line 822 to copy the contents of buf into
kbuf, but a call to strncmp() on line 964 uses buf rather than kbuf. This
problem led to a GPF in strncmp() when X was started on my x86_32 systems.
X triggered the behavior with a write of "target PCI:0000:01:00.0" to
/dev/vga_arbiter.
The patch has been tested against 2.6.32.1 and observed to correct the GPF
observed when starting X or manually writing the string "target
PCI:0000:01:00.0" to /dev/vga_arbiter.
Signed-off-by: Andy Getzendanner <james.getzendanner@students.olin.edu>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/drm_gem.c')
0 files changed, 0 insertions, 0 deletions