This is a note to let you know that I've just added the patch titled
vmwgfx: Fix assignment in vmw_framebuffer_create_handle
to the 3.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
vmwgfx-fix-assignment-in-vmw_framebuffer_create_handle.patch
and it can be found in the queue-3.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From bf9c05d5b6d19b3e4c9fe21047694e94f48db89b Mon Sep 17 00:00:00 2001
From: Ryan Mallon <[email protected]>
Date: Sat, 28 Jan 2012 08:51:40 +1100
Subject: vmwgfx: Fix assignment in vmw_framebuffer_create_handle
From: Ryan Mallon <[email protected]>
commit bf9c05d5b6d19b3e4c9fe21047694e94f48db89b upstream.
The assignment of handle in vmw_framebuffer_create_handle doesn't actually do
anything useful and is incorrectly assigning an integer value to a pointer
argument. It appears that this is a typo and should be dereferencing handle
rather than assigning to it directly. This fixes a bug where an undefined
handle value is potentially returned to user-space.
Signed-off-by: Ryan Mallon <[email protected]>
Reviewed-by: Jakob Bornecrantz<[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -313,7 +313,7 @@ int vmw_framebuffer_create_handle(struct
unsigned int *handle)
{
if (handle)
- handle = 0;
+ *handle = 0;
return 0;
}
Patches currently in stable-queue which might be from [email protected] are
queue-3.0/vmwgfx-fix-assignment-in-vmw_framebuffer_create_handle.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
