<feed xmlns='http://www.w3.org/2005/Atom'>
<title>src-test2/sys/dev/drm, branch release/11.4.0</title>
<subtitle>FreeBSD source tree</subtitle>
<id>https://cgit-dev.freebsd.org/src-test2/atom?h=release%2F11.4.0</id>
<link rel='self' href='https://cgit-dev.freebsd.org/src-test2/atom?h=release%2F11.4.0'/>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/'/>
<updated>2018-03-23T02:37:08Z</updated>
<entry>
<title>MFC r331333: Fix kernel memory disclosure in drm_infobufs</title>
<updated>2018-03-23T02:37:08Z</updated>
<author>
<name>Ed Maste</name>
<email>emaste@FreeBSD.org</email>
</author>
<published>2018-03-23T02:37:08Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=b8728e7d368684023844ae09cbaced0595430e99'/>
<id>urn:sha1:b8728e7d368684023844ae09cbaced0595430e99</id>
<content type='text'>
drm_infobufs() has a structure on the stack, fills it out and copies it
to userland.  There are 2 elements in the struct that are not filled out
and left uninitialized.  This will leak uninitialized kernel stack data
to userland.

Submitted by:	Domagoj Stolfa &lt;ds815@cam.ac.uk&gt;
Reported by:	Ilja Van Sprundel &lt;ivansprundel@ioactive.com&gt;
Security:	Kernel memory disclosure (798)
</content>
</entry>
<entry>
<title>MFC r331339: Correct signedness bug in drm_modeset_ctl</title>
<updated>2018-03-23T02:33:30Z</updated>
<author>
<name>Ed Maste</name>
<email>emaste@FreeBSD.org</email>
</author>
<published>2018-03-23T02:33:30Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=5d863a302bba9f5e494478ae469b583da5a65043'/>
<id>urn:sha1:5d863a302bba9f5e494478ae469b583da5a65043</id>
<content type='text'>
drm_modeset_ctl() takes a signed in from userland, does a boundscheck,
and then uses it to index into a structure and write to it.  The
boundscheck only checks upper bound, and never checks for nagative
values.  If the int coming from userland is negative [after conversion]
it will bypass the boundscheck, perform a negative index into an array
and write to it, causing memory corruption.

Note that this is in the "old" drm driver; this issue does not exist
in drm2.

Reported by:	Ilja Van Sprundel &lt;ivansprundel@ioactive.com&gt;
Reviewed by:	cem
Sponsored by:	The FreeBSD Foundation
</content>
</entry>
<entry>
<title>MFC r317055,r317056 (glebius): Include sys/vmmeter.h as included</title>
<updated>2018-03-15T19:08:33Z</updated>
<author>
<name>Kyle Evans</name>
<email>kevans@FreeBSD.org</email>
</author>
<published>2018-03-15T19:08:33Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=ec4092e367a2a123f534b57e4b8b4e9753054a02'/>
<id>urn:sha1:ec4092e367a2a123f534b57e4b8b4e9753054a02</id>
<content type='text'>
r317055: All these files need sys/vmmeter.h, but now they got it implicitly
included via sys/pcpu.h.

r317056: Typo!
</content>
</entry>
<entry>
<title>MFC r327231,r327232:</title>
<updated>2018-03-05T06:59:30Z</updated>
<author>
<name>Eitan Adler</name>
<email>eadler@FreeBSD.org</email>
</author>
<published>2018-03-05T06:59:30Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=89c93f3260160931c302bee60fd8f18e2e572d23'/>
<id>urn:sha1:89c93f3260160931c302bee60fd8f18e2e572d23</id>
<content type='text'>
kernel: Fix several typos and minor errors
lib: Fix several typos and minor errors

- duplicate words
- typos
- references to old versions of FreeBSD
</content>
</entry>
<entry>
<title>MFC r315281:</title>
<updated>2017-03-28T06:07:59Z</updated>
<author>
<name>Konstantin Belousov</name>
<email>kib@FreeBSD.org</email>
</author>
<published>2017-03-28T06:07:59Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=b4e0b561e4de47293978b03b4592c5ea9cdb153c'/>
<id>urn:sha1:b4e0b561e4de47293978b03b4592c5ea9cdb153c</id>
<content type='text'>
Use atop() instead of OFF_TO_IDX() for convertion of addresses or
addresses offsets, as intended.

MFC r315580 (by alc):
Simplify the logic for clipping the range returned by the pager to fit
within the map entry.
Use atop() rather than OFF_TO_IDX() on addresses.
</content>
</entry>
<entry>
<title>sys/dev: minor spelling fixes.</title>
<updated>2016-05-03T03:41:25Z</updated>
<author>
<name>Pedro F. Giffuni</name>
<email>pfg@FreeBSD.org</email>
</author>
<published>2016-05-03T03:41:25Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=453130d9bfc1c6d68b366dfcb041689d69f81295'/>
<id>urn:sha1:453130d9bfc1c6d68b366dfcb041689d69f81295</id>
<content type='text'>
Most affect comments, very few have user-visible effects.
</content>
</entry>
<entry>
<title>As &lt;machine/param.h&gt; is included from &lt;sys/param.h&gt;, there is no need</title>
<updated>2016-02-22T09:04:36Z</updated>
<author>
<name>Svatopluk Kraus</name>
<email>skra@FreeBSD.org</email>
</author>
<published>2016-02-22T09:04:36Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=d6849317c579f3a976e8ed3a1708e1e17c813ad9'/>
<id>urn:sha1:d6849317c579f3a976e8ed3a1708e1e17c813ad9</id>
<content type='text'>
to include it explicitly when &lt;sys/param.h&gt; is already included.

Reviewed by:	alc, kib
Differential Revision:	https://reviews.freebsd.org/D5378
</content>
</entry>
<entry>
<title>As &lt;machine/pmap.h&gt; is included from &lt;vm/pmap.h&gt;, there is no need to</title>
<updated>2016-02-22T09:02:20Z</updated>
<author>
<name>Svatopluk Kraus</name>
<email>skra@FreeBSD.org</email>
</author>
<published>2016-02-22T09:02:20Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=a1e1814d763ae0dd1c50a85bbd6884969ed26126'/>
<id>urn:sha1:a1e1814d763ae0dd1c50a85bbd6884969ed26126</id>
<content type='text'>
include it explicitly when &lt;vm/pmap.h&gt; is already included.

Reviewed by:	alc, kib
Differential Revision:	https://reviews.freebsd.org/D5373
</content>
</entry>
<entry>
<title>Instead of defining the actualy user and group id in the drmP.h files</title>
<updated>2015-08-11T16:51:44Z</updated>
<author>
<name>Koop Mast</name>
<email>kwm@FreeBSD.org</email>
</author>
<published>2015-08-11T16:51:44Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=d8f4b935268834bc762c5eafbfccd560dbdd143c'/>
<id>urn:sha1:d8f4b935268834bc762c5eafbfccd560dbdd143c</id>
<content type='text'>
define GID_VIDEO in sys/conf.h, and use it together with UID_ROOT
to define DRM_DEV_UID and DRM_DEV_GID in the drmP.h files.

So there is one place where the UID's and GID's are defined.

Submitted by:	ed@
Reviewed by:	ed@, dumbbell@
Differential Revision:	https://reviews.freebsd.org/D3360
</content>
</entry>
<entry>
<title>Add a new group named 'video' with the id of 44. And make drm create</title>
<updated>2015-08-09T12:58:56Z</updated>
<author>
<name>Koop Mast</name>
<email>kwm@FreeBSD.org</email>
</author>
<published>2015-08-09T12:58:56Z</published>
<link rel='alternate' type='text/html' href='https://cgit-dev.freebsd.org/src-test2/commit/?id=34c7eb57ed1cbb97c5ea93fa3d4f10730172c1a4'/>
<id>urn:sha1:34c7eb57ed1cbb97c5ea93fa3d4f10730172c1a4</id>
<content type='text'>
devices in /dev/dri/ with this new group.

This will allow ports and users to more easily access to these devices
for OpenGL and OpenCL support.

Reviewed by:	dumbbell@
Approved by:	dumbbell@
Differential Revision:	https://reviews.freebsd.org/D1260
</content>
</entry>
</feed>
