Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 13 6月, 2012 2 次提交
  3. 20 5月, 2012 1 次提交
  5. 13 4月, 2012 2 次提交
  7. 10 4月, 2012 1 次提交
  9. 02 4月, 2012 2 次提交
  11. 29 3月, 2012 2 次提交
  13. 10 2月, 2012 2 次提交
  15. 27 1月, 2012 1 次提交
  17. 17 1月, 2012 1 次提交
  19. 13 1月, 2012 1 次提交
  21. 06 1月, 2012 1 次提交
  23. 08 11月, 2011 2 次提交
  25. 29 10月, 2011 2 次提交
  27. 21 10月, 2011 1 次提交
  29. 21 9月, 2011 1 次提交
  31. 15 9月, 2011 1 次提交
  33. 24 8月, 2011 1 次提交
    • É
      [IA64] agp/hp-agp: Allow binding user memory to the AGP GART · fc000154
      由 Émeric Maschino 提交于 
      dmesg reports:
[   29.365973] [TTM] AGP Bind memory failed.
[   29.366015] radeon 0000:80:00.0: object_init failed for (4096, 0x00000002)
[   29.366052] radeon 0000:80:00.0: (-22) create WB bo failed
[   29.366087] radeon 0000:80:00.0: Disabling GPU acceleration
[   29.366124] [drm] radeon: cp finalized
[   29.366168] [drm] radeon: cp finalized
[   29.366210] [TTM] Finalizing pool allocator.
[   29.366924] [TTM] Zone  kernel: Used memory at exit: 0 kiB.
[   29.366961] [TTM] Zone   dma32: Used memory at exit: 0 kiB.
[   29.366996] [drm] radeon: ttm finalized
[   29.367030] [drm] Forcing AGP to PCI mode

This patch allows binding user memory to the AGP GART on zx1-based
systems. dmesg thus no more complains about AGP bind memory failure,
disabled GPU acceleration or AGP mode forced to PCI.

Original work from Francisco Jerez in agp/amd-k7
(https://lkml.org/lkml/2010/10/15/469).
Tested-by: NÉmeric Maschino <emeric.maschino@gmail.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>
      fc000154
  35. 13 7月, 2011 1 次提交
  37. 22 5月, 2011 1 次提交
  39. 14 5月, 2011 1 次提交
  41. 21 4月, 2011 2 次提交
    • V
      agp: fix arbitrary kernel memory writes · 194b3da8
      由 Vasiliy Kulikov 提交于 
      pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
cmds of agp_ioctl() and passed to agpioc_bind_wrap().  As said in the
comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
and it is not checked at all in case of AGPIOC_UNBIND.  As a result, user
with sufficient privileges (usually "video" group) may generate either
local DoS or privilege escalation.
Signed-off-by: NVasiliy Kulikov <segoon@openwall.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>
      194b3da8
    • V
      agp: fix OOM and buffer overflow · b522f021
      由 Vasiliy Kulikov 提交于 
      page_count is copied from userspace.  agp_allocate_memory() tries to
check whether this number is too big, but doesn't take into account the
wrap case.  Also agp_create_user_memory() doesn't check whether
alloc_size is calculated from num_agp_pages variable without overflow.
This may lead to allocation of too small buffer with following buffer
overflow.

Another problem in agp code is not addressed in the patch - kernel memory
exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls).  It is not checked
whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()).
Each allocation is limited to 16KB, though, there is no per-process limit.
This might lead to OOM situation, which is not even solved in case of the
caller death by OOM killer - the memory is allocated for another (faked) process.
Signed-off-by: NVasiliy Kulikov <segoon@openwall.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>
      b522f021
  43. 31 3月, 2011 1 次提交
  45. 23 2月, 2011 1 次提交
  47. 22 2月, 2011 1 次提交
  49. 16 2月, 2011 1 次提交
  51. 04 2月, 2011 3 次提交
  53. 25 1月, 2011 1 次提交
  55. 15 1月, 2011 1 次提交
  57. 12 1月, 2011 2 次提交