1. 25 Feb, 2010 2 commits
  2. 23 Feb, 2010 6 commits
  3. 16 Feb, 2010 2 commits
  4. 10 Feb, 2010 2 commits
  5. 09 Feb, 2010 16 commits
  6. 25 Jan, 2010 4 commits
  7. 17 Jan, 2010 6 commits
  8. 14 Jan, 2010 2 commits
    • Luca Barbieri's avatar
      drm/nouveau: check pushbuffer bounds in ioctl · 12f735b7
      Luca Barbieri authored
      Currently there is no check that the pushbuffer request bounds are inside
      the TTM BO.
      
      This allows to instruct the kernel to do relocations on user-selected
      addresses, since the relocation bounds checking relies on the request
      bounds.
      
      This can oops the kernel accidentally and is easily exploitable.
      
      This patch adds bound checking and alignment checking for ->offset and
      ->nr_dwords.
      
      It also makes some variables unsigned, which should have no effect,
      but prevents possible bounds checking problems.
      Signed-off-by: default avatarLuca Barbieri <luca@luca-barbieri.com>
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      12f735b7
    • Ben Skeggs's avatar
      drm/nouveau: reserve VGA area for the moment · ac8fb975
      Ben Skeggs authored
      This is to prevent things such as GART tables and other important GPU
      structures being allocated there before we take over fbcon ourselves.
      
      This is more of a workaround for the moment, a better solution will
      require some more invasive changes, but it'll be done at some point.
      Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
      ac8fb975