Vasiliy Kulikov 194b3da873 agp: fix arbitrary kernel memory writes ... pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl cmds of agp_ioctl() and passed to agpioc_bind_wrap(). As said in the comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND, and it is not checked at all in case of AGPIOC_UNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> Signed-off-by: Dave Airlie <airlied@redhat.com>		2011-04-21 12:16:55 +10:00
..
Kconfig	Revert "agp: AMD AGP is used on UP1100 & UP1500 alpha boxen"	2011-02-04 09:42:25 +10:00
Makefile	agp/intel: make intel-gtt.c into a real source file	2010-09-08 21:20:06 +01:00
agp.h	Fix common misspellings	2011-03-31 11:26:23 -03:00
ali-agp.c	agp: use scratch page on memory remove and at GATT creation V4	2010-04-23 13:59:18 +10:00
alpha-agp.c	const: mark struct vm_struct_operations	2009-09-27 11:39:25 -07:00
amd-k7-agp.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
amd64-agp.c	amd64-agp: fix crash at second module load	2011-02-23 18:29:17 +10:00
ati-agp.c	agp: use scratch page on memory remove and at GATT creation V4	2010-04-23 13:59:18 +10:00
backend.c	agp: kill agp_(map|unmap)_page	2010-09-21 11:36:11 +01:00
compat_ioctl.c	agp: kill agp_flush_chipset and corresponding ioctl	2010-11-23 20:14:45 +00:00
compat_ioctl.h	agp: kill agp_flush_chipset and corresponding ioctl	2010-11-23 20:14:45 +00:00
efficeon-agp.c	agp: efficeon-agp: do not use PCI resources before pci_enable_device()	2010-08-05 12:28:21 +10:00
frontend.c	agp: kill agp_flush_chipset and corresponding ioctl	2010-11-23 20:14:45 +00:00
generic.c	agp: fix arbitrary kernel memory writes	2011-04-21 12:16:55 +10:00
hp-agp.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
i460-agp.c	Update broken web addresses in the kernel.	2010-10-18 11:03:14 +02:00
intel-agp.c	agp: ensure GART has an address before enabling it	2011-02-04 09:43:57 +10:00
intel-agp.h	agp/intel: Experiment with a 855GM GWB bit	2011-02-22 15:52:41 +00:00
intel-gtt.c	agp/intel: Experiment with a 855GM GWB bit	2011-02-22 15:52:41 +00:00
isoch.c	agp: use dev_printk when possible	2008-08-12 10:13:38 +10:00
nvidia-agp.c	agp: use scratch page on memory remove and at GATT creation V4	2010-04-23 13:59:18 +10:00
parisc-agp.c	parisc-agp: fix missing slab.h include	2010-10-29 13:26:48 -04:00
sgi-agp.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
sis-agp.c	sis-agp: Remove SIS 760, handled by amd64-agp	2010-05-19 10:11:23 +10:00
sworks-agp.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
uninorth-agp.c	agp/uninorth: Fix oops caused by flushing too much	2010-06-02 17:50:37 +10:00
via-agp.c	Fix common misspellings	2011-03-31 11:26:23 -03:00