Re: PATCH: 2.6.7-rc3 drivers/char/drm/gamma_dma.c: several user/kernelpointer bugs

[Dave Airlie]

> gamma_dma_priority and gamma_dma_send_buffers both deref d->send_indices
> and/or d->send_sizes.  When these functions are called from gamma_dma,
> these pointers are user pointers and are thus not safe to deref.  This patch
> copies over the pointers inside gamma_dma_priority and
> gamma_dma_send_buffers.  Let me know if you have any questions or if I've
> made a mistake.

okay I've checked this into the drm bk tree and DRM CVS, I've no way to
test it apart from visual inspection and it compiles, I've asked Linus to
sync the drm tree again, I probably need to add some __user annotations in
a few places..

Dave.

-- 
David Airlie, Software Engineer
http://www.skynet.ie/~airlied / airlied at skynet.ie
pam_smb / Linux DECstation / Linux VAX / ILUG person

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/