diff options
| author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-06-22 12:47:52 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-06-22 12:47:52 -0400 |
| commit | fa1279439fdff1c607166b73e1cb20798bfee48d (patch) | |
| tree | 323e64dee9385d9d12a139b65977010272b6016a | |
| parent | 98c0a573c41e2e7b6cd68819607cc8d97cd3c82b (diff) | |
| download | longterm-queue-2.6.34-fa1279439fdff1c607166b73e1cb20798bfee48d.tar.gz | |
fix mislocation in agp-fix-arbitrary-kernel-memory-writes.patch
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
| -rw-r--r-- | queue/agp-fix-arbitrary-kernel-memory-writes.patch | 31 |
1 files changed, 16 insertions, 15 deletions
diff --git a/queue/agp-fix-arbitrary-kernel-memory-writes.patch b/queue/agp-fix-arbitrary-kernel-memory-writes.patch index 8d71bd1..79eb569 100644 --- a/queue/agp-fix-arbitrary-kernel-memory-writes.patch +++ b/queue/agp-fix-arbitrary-kernel-memory-writes.patch @@ -1,4 +1,4 @@ -From 4331463bb18c8abce20bd0b2f5d76f2b109c3c12 Mon Sep 17 00:00:00 2001 +From bbc89cbf7535d10e438bd40df6bbee536f929470 Mon Sep 17 00:00:00 2001 From: Vasiliy Kulikov <segoon@openwall.com> Date: Thu, 14 Apr 2011 20:55:16 +0400 Subject: [PATCH] agp: fix arbitrary kernel memory writes @@ -17,21 +17,10 @@ Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c -index fb86708..94c0321 100644 +index fb86708..13a3446 100644 --- a/drivers/char/agp/generic.c +++ b/drivers/char/agp/generic.c -@@ -1118,14 +1118,19 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type) - if (type != mem->type) - return -EINVAL; - -+ num_entries = agp_num_entries(); -+ if (((pg_start + mem->page_count) > num_entries) || -+ ((pg_start + mem->page_count) < pg_start)) -+ return -EINVAL; -+ - mask_type = bridge->driver->agp_type_to_mask_type(bridge, type); - if (mask_type != 0) { - /* The generic routines know nothing of memory types */ +@@ -1124,8 +1124,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type) return -EINVAL; } @@ -42,7 +31,7 @@ index fb86708..94c0321 100644 return -EINVAL; j = pg_start; -@@ -1159,7 +1164,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type) +@@ -1159,7 +1159,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type) { size_t i; struct agp_bridge_data *bridge; @@ -51,6 +40,18 @@ index fb86708..94c0321 100644 bridge = mem->bridge; if (!bridge) +@@ -1171,6 +1171,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type) + if (type != mem->type) + return -EINVAL; + ++ num_entries = agp_num_entries(); ++ if (((pg_start + mem->page_count) > num_entries) || ++ ((pg_start + mem->page_count) < pg_start)) ++ return -EINVAL; ++ + mask_type = bridge->driver->agp_type_to_mask_type(bridge, type); + if (mask_type != 0) { + /* The generic routines know nothing of memory types */ -- 1.7.4.4 |