1. 19 6月, 2008 7 次提交
  2. 13 6月, 2008 1 次提交
  3. 30 4月, 2008 1 次提交
  4. 26 4月, 2008 2 次提交
  5. 20 2月, 2008 2 次提交
  6. 19 2月, 2008 3 次提交
  7. 06 2月, 2008 1 次提交
  8. 05 2月, 2008 11 次提交
  9. 30 1月, 2008 3 次提交
  10. 24 1月, 2008 1 次提交
  11. 30 10月, 2007 1 次提交
  12. 18 10月, 2007 1 次提交
  13. 17 10月, 2007 2 次提交
  14. 15 10月, 2007 2 次提交
    • J
      fix use after free in amd create gatt pages · bdc3e603
      Jesper Juhl 提交于
      Coverity spotted a "use after free" bug in
      drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages().
      
      The problem is this:
      	If "entry = kzalloc(sizeof(struct amd_page_map), GFP_KERNEL);"
      fails, then there's a loop in the function to free all entries
      allocated so far and break out of the allocation loop. That in itself
      is pretty sane, but then the (now freed) 'tables' is assigned to
      amd_irongate_private.gatt_pages and 'retval' is set to -ENOMEM which
      causes amd_free_gatt_pages(); to be called at the end of the function.
      The problem with this is that amd_free_gatt_pages() will then loop
      'amd_irongate_private.num_tables' times and try to free each entry in
      tables[] - this is bad since tables has already been freed and
      furthermore it will call kfree(tables) at the end - a double free.
      
      This patch removes the freeing loop in amd_create_gatt_pages() and
      instead relies entirely on the call to amd_free_gatt_pages() to free
      everything we allocated in case of an error. It also sets
      amd_irongate_private.num_tables to the actual number of entries
      allocated instead of just using the value passed in from the caller -
      this ensures that amd_free_gatt_pages() will only attempt to free
      stuff that was actually allocated.
      Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      bdc3e603
    • D
      AGP fix race condition between unmapping and freeing pages · a2721e99
      Dave Airlie 提交于
      With Andi's clflush fixup, we were getting hangs on server exit, flushing the
      mappings after freeing each page helped.
      
      This showed up a race condition where the pages after being freed could be
      reused before the agp mappings had been flushed.  Flushing after each single
      page is a bad thing for future drm work, so make the page destroy a two pass
      unmapping all the pages, flushing the mappings, and then destroying the pages.
      Signed-off-by: NDave Airlie <airlied@linux.ie>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      a2721e99
  15. 07 10月, 2007 1 次提交
  16. 20 9月, 2007 1 次提交