Re: PATCH: 2.6.7-rc3 drivers/char/drm/gamma_dma.c: several user/kernel pointer bugs

2004-06-14 Thread Alan Cox
On Iau, 2004-06-10 at 10:46, Dave Airlie wrote: okay I've checked this into the drm bk tree and DRM CVS, I've no way to test it apart from visual inspection and it compiles, I've asked Linus to sync the drm tree again, I probably need to add some __user annotations in a few places.. I've got

Re: PATCH: 2.6.7-rc3 drivers/char/drm/gamma_dma.c: several user/kernel pointer bugs

2004-06-10 Thread viro
On Wed, Jun 09, 2004 at 03:53:40PM -0700, Robert T. Johnson wrote: gamma_dma_priority and gamma_dma_send_buffers both deref d-send_indices and/or d-send_sizes. When these functions are called from gamma_dma, these pointers are user pointers and are thus not safe to deref. This patch copies

Re: PATCH: 2.6.7-rc3 drivers/char/drm/gamma_dma.c: several user/kernel pointer bugs

2004-06-10 Thread Dave Airlie
I'll fix this in the DRM bk tree and push to Linus... Dave. On Thu, 10 Jun 2004 [EMAIL PROTECTED] wrote: On Wed, Jun 09, 2004 at 03:53:40PM -0700, Robert T. Johnson wrote: gamma_dma_priority and gamma_dma_send_buffers both deref d-send_indices and/or d-send_sizes. When these functions

Re: PATCH: 2.6.7-rc3 drivers/char/drm/gamma_dma.c: several user/kernel pointer bugs

2004-06-10 Thread Dave Airlie
gamma_dma_priority and gamma_dma_send_buffers both deref d-send_indices and/or d-send_sizes. When these functions are called from gamma_dma, these pointers are user pointers and are thus not safe to deref. This patch copies over the pointers inside gamma_dma_priority and

PATCH: 2.6.7-rc3 drivers/char/drm/gamma_dma.c: several user/kernel pointer bugs

2004-06-09 Thread Robert T. Johnson
gamma_dma_priority and gamma_dma_send_buffers both deref d-send_indices and/or d-send_sizes. When these functions are called from gamma_dma, these pointers are user pointers and are thus not safe to deref. This patch copies over the pointers inside gamma_dma_priority and