From: Greg Kroah-Hartman Date: Sat, 9 Nov 2013 06:22:01 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.4.69~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5f234473e75b414d32dd3a31d24d6440aeb7ae13;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch --- diff --git a/queue-3.4/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch b/queue-3.4/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch new file mode 100644 index 00000000000..12801e07374 --- /dev/null +++ b/queue-3.4/drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch @@ -0,0 +1,52 @@ +From b062672e305ce071f21eb9e18b102c2a430e0999 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 16 Oct 2013 11:22:44 +0100 +Subject: drm: Prevent overwriting from userspace underallocating core ioctl structs + +From: Chris Wilson + +commit b062672e305ce071f21eb9e18b102c2a430e0999 upstream. + +Apply the protections from + +commit 1b2f1489633888d4a06028315dc19d65768a1c05 +Author: Dave Airlie +Date: Sat Aug 14 20:20:34 2010 +1000 + + drm: block userspace under allocating buffer and having drivers overwrite it (v2) + +to the core ioctl structs as well, for we found one instance where there +is a 32-/64-bit size mismatch and were guilty of writing beyond the end +of the user's buffer. + +Signed-off-by: Chris Wilson +Cc: Dave Airlie +Reviewed-by: Ville Syrjälä +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_drv.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -420,9 +420,16 @@ long drm_ioctl(struct file *filp, + asize = drv_size; + } + else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) { ++ u32 drv_size; ++ + ioctl = &drm_ioctls[nr]; +- cmd = ioctl->cmd; ++ ++ drv_size = _IOC_SIZE(ioctl->cmd); + usize = asize = _IOC_SIZE(cmd); ++ if (drv_size > asize) ++ asize = drv_size; ++ ++ cmd = ioctl->cmd; + } else + goto err_i1; + diff --git a/queue-3.4/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch b/queue-3.4/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch new file mode 100644 index 00000000000..e56c8e2d148 --- /dev/null +++ b/queue-3.4/drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch @@ -0,0 +1,35 @@ +From c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 10 Oct 2013 16:45:27 -0400 +Subject: drm/radeon/atom: workaround vbios bug in transmitter table on rs780 + +From: Alex Deucher + +commit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream. + +Some rs780 asics seem to be affected as well. + +See: +http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=91f3a6aaf280294b07c05dfe606e6c27b7ba3c72 + +Fixes: +https://bugzilla.kernel.org/show_bug.cgi?id=60791 + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_encoders.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -1430,7 +1430,7 @@ radeon_atom_encoder_dpms_dig(struct drm_ + * does the same thing and more. + */ + if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730) && +- (rdev->family != CHIP_RS880)) ++ (rdev->family != CHIP_RS780) && (rdev->family != CHIP_RS880)) + atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0); + } + if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) { diff --git a/queue-3.4/series b/queue-3.4/series index 7bc3af88ce9..87c8f976bf6 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -22,3 +22,5 @@ xtensa-don-t-use-alternate-signal-stack-on-threads.patch lib-scatterlist.c-don-t-flush_kernel_dcache_page-on-slab-page.patch aacraid-missing-capable-check-in-compat-ioctl.patch mm-fix-aio-performance-regression-for-database-caused-by-thp.patch +drm-prevent-overwriting-from-userspace-underallocating-core-ioctl-structs.patch +drm-radeon-atom-workaround-vbios-bug-in-transmitter-table-on-rs780.patch