linux-kernel - [git pull] agp-fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.1001110514490.19527@skynet.skynet.ie>
Date:	Mon, 11 Jan 2010 05:15:54 +0000 (GMT)
From:	Dave Airlie <airlied@...ux.ie>
To:	torvalds@...ux-foundation.org
cc:	linux-kernel@...r.kernel.org
Subject: [git pull] agp-fixes


Hi Linus,

Please pull the 'agp-fixes' branch from
ssh://master.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6.git agp-fixes

One fix for a real oops on IA64 AGP system + 2 minor fixes.

Dave.

 drivers/char/agp/backend.c |   13 +++++++++----
 drivers/char/agp/hp-agp.c  |    6 ++++--
 2 files changed, 13 insertions(+), 6 deletions(-)

commit 3d4a7882b11299104a0e74425dece2e26ac98024
Author: Bjorn Helgaas <bjorn.helgaas@...com>
Date:   Thu Jan 7 12:58:56 2010 -0700

    agp/hp: fail gracefully if we don't find an IOC
    
    Bail out if we don't find an enclosing IOC.  Previously, if we didn't
    find one, we tried to set things up using garbage for the SBA/IOC register
    address, which causes a crash.
    
    This crash only happens if firmware supplies a defective ACPI namespace, so
    it doesn't fix any problems in the field.
    
    Signed-off-by: Bjorn Helgaas <bjorn.helgaas@...com>
    Signed-off-by: Dave Airlie <airlied@...hat.com>

commit 67fe63b0715ccfaefa0af8a6e705c5470ee5cada
Author: Bjorn Helgaas <bjorn.helgaas@...com>
Date:   Thu Jan 7 12:58:51 2010 -0700

    agp/hp: fixup hp agp after ACPI changes
    
    Commit 15b8dd53f5ffa changed the string in info->hardware_id from a static
    array to a pointer and added a length field.  But instead of changing
    "sizeof(array)" to "length", we changed it to "sizeof(length)" (== 4),
    which corrupts the string we're trying to null-terminate.
    
    We no longer even need to null-terminate the string, but we *do* need to
    check whether we found a HID.  If there's no HID, we used to have an empty
    array, but now we have a null pointer.
    
    The combination of these defects causes this oops:
    
      Unable to handle kernel NULL pointer dereference (address 0000000000000003)
      modprobe[895]: Oops 8804682956800 [1]
      ip is at zx1_gart_probe+0xd0/0xcc0 [hp_agp]
    
      http://marc.info/?l=linux-ia64&m=126264484923647&w=2
    
    Signed-off-by: Bjorn Helgaas <bjorn.helgaas@...com>
    Reported-by: Émeric Maschino <emeric.maschino@...il.com>
    Signed-off-by: Dave Airlie <airlied@...hat.com>

commit 3f50b0222e4c6ac59a5c4819f8be0fa500970381
Author: Kevin Winchester <kjwinchester@...il.com>
Date:   Tue Nov 17 14:38:45 2009 -0800

    agp: correct missing cleanup on error in agp_add_bridge
    
    While investigating a kmemleak detected leak, I encountered the
    agp_add_bridge function.  It appears to be responsible for freeing
    the agp_bridge_data in the case of a failure, but it is only doing
    so for some errors.
    
    Fix it to always free the bridge data if a failure condition is
    encountered.
    
    Signed-off-by: Kevin Winchester <kjwinchester@...il.com>
    Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
    Signed-off-by: Dave Airlie <airlied@...hat.com>