cpufreq-fix-use-after-free-of-struct-powernow_k8_data.patch
freeze_bdev-don-t-deactivate-successfully-frozen-ms_rdonly-sb.patch
cciss-make-cciss_seq_show-handle-holes-in-the-h-drv-array.patch
-vgaarb-fix-incorrect-dereference-of-userspace-pointer.patch
ioat-fix-infinite-timeout-checking-in-ioat2_quiesce.patch
resource-add-helpers-for-fetching-rlimits.patch
fs-exec.c-restrict-initial-stack-space-expansion-to-rlimit.patch
+++ /dev/null
-From 77c1ff3982c6b36961725dd19e872a1c07df7f3b Mon Sep 17 00:00:00 2001
-From: Andy Getzendanner <james.getzendanner@students.olin.edu>
-Date: Thu, 11 Feb 2010 14:04:48 +1000
-Subject: vgaarb: fix incorrect dereference of userspace pointer.
-
-From: Andy Getzendanner <james.getzendanner@students.olin.edu>
-
-commit 77c1ff3982c6b36961725dd19e872a1c07df7f3b upstream.
-
-This patch corrects a userspace pointer dereference in the VGA arbiter
-in 2.6.32.1.
-
-copy_from_user() is used at line 822 to copy the contents of buf into
-kbuf, but a call to strncmp() on line 964 uses buf rather than kbuf. This
-problem led to a GPF in strncmp() when X was started on my x86_32 systems.
- X triggered the behavior with a write of "target PCI:0000:01:00.0" to
-/dev/vga_arbiter.
-
-The patch has been tested against 2.6.32.1 and observed to correct the GPF
-observed when starting X or manually writing the string "target
-PCI:0000:01:00.0" to /dev/vga_arbiter.
-
-Signed-off-by: Andy Getzendanner <james.getzendanner@students.olin.edu>
-Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Dave Airlie <airlied@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/gpu/vga/vgaarb.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/gpu/vga/vgaarb.c
-+++ b/drivers/gpu/vga/vgaarb.c
-@@ -961,7 +961,7 @@ static ssize_t vga_arb_write(struct file
- remaining -= 7;
- pr_devel("client 0x%p called 'target'\n", priv);
- /* if target is default */
-- if (!strncmp(buf, "default", 7))
-+ if (!strncmp(kbuf, "default", 7))
- pdev = pci_dev_get(vga_default_device());
- else {
- if (!vga_pci_str_to_vars(curr_pos, remaining,