3.4-stable patches

added patches:
	drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch
	drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch

diff --git a/queue-3.4/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch b/queue-3.4/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch
new file mode 100644 (file)
index 0000000..12801e0
--- /dev/null
+++ b/queue-3.4/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch
@@ -0,0 +1,52 @@
+From b062672e305ce071f21eb9e18b102c2a430e0999 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 16 Oct 2013 11:22:44 +0100
+Subject: drm: Prevent overwriting from userspace underallocating core ioctl structs
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit b062672e305ce071f21eb9e18b102c2a430e0999 upstream.
+
+Apply the protections from
+
+commit 1b2f1489633888d4a06028315dc19d65768a1c05
+Author: Dave Airlie <airlied@redhat.com>
+Date:   Sat Aug 14 20:20:34 2010 +1000
+
+    drm: block userspace under allocating buffer and having drivers overwrite it (v2)
+
+to the core ioctl structs as well, for we found one instance where there
+is a 32-/64-bit size mismatch and were guilty of writing beyond the end
+of the user's buffer.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Dave Airlie <airlied@redhat.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_drv.c |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -420,9 +420,16 @@ long drm_ioctl(struct file *filp,
+                       asize = drv_size;
+       }
+       else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
++              u32 drv_size;
++
+               ioctl = &drm_ioctls[nr];
+-              cmd = ioctl->cmd;
++
++              drv_size = _IOC_SIZE(ioctl->cmd);
+               usize = asize = _IOC_SIZE(cmd);
++              if (drv_size > asize)
++                      asize = drv_size;
++
++              cmd = ioctl->cmd;
+       } else
+               goto err_i1;
+ 

diff --git a/queue-3.4/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch b/queue-3.4/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch
new file mode 100644 (file)
index 0000000..e56c8e2
--- /dev/null
+++ b/queue-3.4/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch
@@ -0,0 +1,35 @@
+From c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 10 Oct 2013 16:45:27 -0400
+Subject: drm/radeon/atom: workaround vbios bug in transmitter table on rs780
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream.
+
+Some rs780 asics seem to be affected as well.
+
+See:
+http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=91f3a6aaf280294b07c05dfe606e6c27b7ba3c72
+
+Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=60791
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_encoders.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1430,7 +1430,7 @@ radeon_atom_encoder_dpms_dig(struct drm_
+                        * does the same thing and more.
+                        */
+                       if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) &&
+-                          (rdev->family != CHIP_RS880))
++                          (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880))
+                               atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+               }
+               if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {

diff --git a/queue-3.4/series b/queue-3.4/series
index 7bc3af88ce9a34a4ee96ecf20fe30ef6572b0f6b..87c8f976bf6faaca193bc8ab201777bedd6fb071 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -22,3 +22,5 @@ xtensa-don-t-use-alternate-signal-stack-on-threads.patch
 lib-scatterlist.c-don-t-flush_kernel_dcache_page-on-slab-page.patch
 aacraid-missing-capable-check-in-compat-ioctl.patch
 mm-fix-aio-performance-regression-for-database-caused-by-thp.patch
+drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch
+drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch