Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S265969AbUFJCDe (ORCPT ); Wed, 9 Jun 2004 22:03:34 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S266100AbUFJCDe (ORCPT ); Wed, 9 Jun 2004 22:03:34 -0400 Received: from parcelfarce.linux.theplanet.co.uk ([195.92.249.252]:14818 "EHLO www.linux.org.uk") by vger.kernel.org with ESMTP id S265969AbUFJCDd (ORCPT ); Wed, 9 Jun 2004 22:03:33 -0400 Date: Thu, 10 Jun 2004 03:03:32 +0100 From: viro@parcelfarce.linux.theplanet.co.uk To: "Robert T. Johnson" Cc: faith@valinux.com, dri-devel@lists.sourceforge.net, Linux Kernel Subject: Re: PATCH: 2.6.7-rc3 drivers/char/drm/gamma_dma.c: several user/kernel pointer bugs Message-ID: <20040610020332.GC12308@parcelfarce.linux.theplanet.co.uk> References: <1086821620.32053.120.camel@dooby.cs.berkeley.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1086821620.32053.120.camel@dooby.cs.berkeley.edu> User-Agent: Mutt/1.4.1i Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 698 Lines: 14 On Wed, Jun 09, 2004 at 03:53:40PM -0700, Robert T. Johnson wrote: > gamma_dma_priority and gamma_dma_send_buffers both deref d->send_indices > and/or d->send_sizes. When these functions are called from gamma_dma, > these pointers are user pointers and are thus not safe to deref. This patch > copies over the pointers inside gamma_dma_priority and > gamma_dma_send_buffers. Let me know if you have any questions or if I've > made a mistake. ACK. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/