2005-03-09 00:04:06

by Dave Airlie

Subject: [PATCH] drm missing memset can crash X server...

Egbert Eich reported a bug 2673 on bugs.freedesktop.org and tracked it
down to a missing memset in the setversion ioctl, this causes X server
crashes so I would like to see the fix in a 2.6.11.x tree if possible..

Regards,
Dave.

--
David Airlie, Software Engineer
http://www.skynet.ie/~airlied / airlied at skynet.ie
Linux kernel - DRI, VAX / pam_smb / ILUG

diff -Nru a/drivers/char/drm/drm_ioctl.c b/drivers/char/drm/drm_ioctl.c
--- a/drivers/char/drm/drm_ioctl.c 2005-03-09 10:53:42 +11:00
+++ b/drivers/char/drm/drm_ioctl.c 2005-03-09 10:53:43 +11:00
@@ -326,6 +326,8 @@

DRM_COPY_FROM_USER_IOCTL(sv, argp, sizeof(sv));

+ memset(&version, 0, sizeof(version));
+
dev->driver->version(&version);
retv.drm_di_major = DRM_IF_MAJOR;
retv.drm_di_minor = DRM_IF_MINOR;

2005-03-09 06:59:03

by Chris Wright

Subject: Re: [PATCH] drm missing memset can crash X server...

* Dave Airlie ([email protected]) wrote:
>
> Egbert Eich reported a bug 2673 on bugs.freedesktop.org and tracked it
> down to a missing memset in the setversion ioctl, this causes X server
> crashes so I would like to see the fix in a 2.6.11.x tree if possible..

Could you please add Signed-off-by? Do I read this patch correctly that
it effectively disables the DRM_COPY in ->version callbacks?

thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net

2005-03-09 22:47:12

by Dave Airlie

Subject: Re: [PATCH] drm missing memset can crash X server...

>
> Could you please add Signed-off-by? Do I read this patch correctly that
> it effectively disables the DRM_COPY in ->version callbacks?

I'll resend the patch now .. no it just zeros out the structure on the
stack so that the version callback doesn't get a garbage structure to copy
into...

Dave.


--
David Airlie, Software Engineer
http://www.skynet.ie/~airlied / airlied at skynet.ie
Linux kernel - DRI, VAX / pam_smb / ILUG