Just a suggestion that comes to mind as I'm crawling through the
kernel-level code...  
[the xfree 4.2.0 version]

but it looks to me like if userland passes in an incorrect context number
in a call to DRM_IOCTL_LOCK, it could cause a kernel panic, due to
no array bounds checking in

drm_drv.h, DRM(lock), 
  q = dev->queuelist[lock.context]





-------------------------------------------------------
This SF.net email is sponsored by: SlickEdit Inc. Develop an edge.
The most comprehensive and flexible code editor you can use.
Code faster. C/C++, C#, Java, HTML, XML, many more. FREE 30-Day Trial.
www.slickedit.com/sourceforge
_______________________________________________
Dri-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/dri-devel

Reply via email to