lwn.git/drivers/char/agp/generic.c, branch v4.1.21

agp: change agp_free_page_array to use kvfree

2015-01-29T02:37:41+00:00

Change agp_free_page_array to use kvfree function, remove the duplicated code. Signed-off-by: Yalin Wang Signed-off-by: Dave Airlie

drivers/char: delete non-required instances of include

2014-02-07T23:10:19+00:00

None of these files are actually using any __init type directives and hence don't need to include . Most are just a left over from __devinit and __cpuinit removal, or simply due to code getting copied from one driver to the next. Cc: David Airlie Cc: Matt Mackall Cc: Herbert Xu Cc: Kukjin Kim Cc: Corey Minyard Cc: Chris Metcalf Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Peter Huewe Cc: Ashley Lai Cc: Marcel Selhorst Signed-off-by: Paul Gortmaker Signed-off-by: Greg Kroah-Hartman

agp: Support 64-bit APBASE

2014-01-07T00:49:22+00:00

Per the AGP 3.0 spec, APBASE is a standard PCI BAR and may be either 32 bits or 64 bits wide. Many drivers read APBASE directly, but they only handled 32-bit BARs. The PCI core reads APBASE at enumeration-time. Use pci_bus_address() instead of reading it again in the driver. This works correctly for both 32-bit and 64-bit BARs. Signed-off-by: Bjorn Helgaas Reviewed-by: Daniel Vetter

agp: Use u32 __iomem annotation to silence sparse warning.

2012-04-12T16:56:21+00:00

Replace "void *" by "u32 __iomem *" to silence sparse warning. Signed-off-by: Santosh Nayak Signed-off-by: Dave Airlie

agp: Remove 'break' after 'return' statement.

2012-04-12T16:56:17+00:00

'break' is unnecessary after 'return' statement. Remove all such 'break' as clean up. Signed-off-by: Santosh Nayak Signed-off-by: Dave Airlie

agp: Fix multi-line warning message whitespace

2012-01-06T09:32:02+00:00

Signed-off-by: Tormod Volden Reviewed-by: Corbin Simpson Signed-off-by: Dave Airlie

agp: fix arbitrary kernel memory writes

2011-04-21T02:16:55+00:00

pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND, and it is not checked at all in case of AGPIOC_UNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation. Signed-off-by: Vasiliy Kulikov Signed-off-by: Dave Airlie

agp: fix OOM and buffer overflow

2011-04-21T01:51:04+00:00

page_count is copied from userspace. agp_allocate_memory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agp_create_user_memory() doesn't check whether alloc_size is calculated from num_agp_pages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow. Another problem in agp code is not addressed in the patch - kernel memory exhaustion (AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls). It is not checked whether requested pid is a pid of the caller (no check in agpioc_reserve_wrap()). Each allocation is limited to 16KB, though, there is no per-process limit. This might lead to OOM situation, which is not even solved in case of the caller death by OOM killer - the memory is allocated for another (faked) process. Signed-off-by: Vasiliy Kulikov Signed-off-by: Dave Airlie

agp: kill agp_rebind_memory

2010-11-23T20:14:46+00:00

Its only user, intel-gtt.c is now gone. Cc: Dave Airlie Signed-off-by: Daniel Vetter Signed-off-by: Chris Wilson

agp: kill agp_flush_chipset and corresponding ioctl

2010-11-23T20:14:45+00:00

The intel drm calls the chipset functions now directly. Userspace never called the corresponding ioctl, hence it can be killed, too. Cc: Dave Airlie Signed-off-by: Daniel Vetter Signed-off-by: Chris Wilson