forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/gpu/drm
History
Dan Carpenter 9a0511abab drm/i810: Prevent underflow in ioctl 
commit 4f69851fba upstream.

The "used" variables here come from the user in the ioctl and it can be
negative.  It could result in an out of bounds write.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-13 08:52:44 +01:00
..
amd drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs 2019-12-01 09:16:11 +01:00
arc drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
arm drm/arm/hdlcd: Allow a bit of clock tolerance 2019-06-25 11:35:58 +08:00
armada drm/armada: remove obsolete fb unreferencing kfifo and workqueue 2018-07-30 11:53:06 +01:00
ast drm/ast: Fixed reboot test may cause system hanged 2019-09-06 10:21:59 +02:00
atmel-hlcdc drm/atmel-hlcdc: revert shift by 8 2019-12-05 09:21:33 +01:00
bochs drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
bridge drm/rockchip: Check for fast link training before enabling psr 2019-10-07 18:56:32 +02:00
cirrus drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up 2019-04-20 09:16:00 +02:00
etnaviv drm/etnaviv: add missing failure path to destroy suballoc 2019-07-10 09:53:43 +02:00
exynos drm/exynos: fix missing decrement of retry counter 2019-08-25 10:47:57 +02:00
fsl-dcu drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
gma500 drm/gma500/cdv: Check vbt config bits when detecting lvds panels 2019-06-11 12:20:54 +02:00
hisilicon drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer 2018-11-21 09:19:10 +01:00
i2c Merge branch 'drm-tda9950-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes 2018-10-04 10:32:14 +10:00
i810 drm/i810: Prevent underflow in ioctl 2019-12-13 08:52:44 +01:00
i915 drm/i915/userptr: Try to acquire the page lock around set_page_dirty() 2019-12-01 09:16:12 +01:00
imx drm/imx: only send event on crtc disable if kept disabled 2019-07-10 09:53:44 +02:00
lib
mediatek drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto 2019-09-19 09:09:39 +02:00
meson drm/meson: Add support for XBGR8888 & ABGR8888 formats 2019-09-19 09:09:36 +02:00
mga
mgag200 drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
msm drm/msm: fix memleak on release 2019-12-13 08:52:44 +01:00
mxsfb
nouveau drm/nouveau/kms/nv50-: Don't create MSTMs for eDP connectors 2019-10-11 18:21:03 +02:00
omapdrm drm/omap: fix max fclk divider for omap36xx 2019-10-11 18:21:01 +02:00
panel drm/panel: check failure cases in the probe func 2019-10-07 18:56:31 +02:00
pl111 drm/pl111: Initialize clock spinlock early 2019-06-15 11:54:00 +02:00
qxl qxl: fix null-pointer crash during suspend 2019-11-20 18:45:56 +01:00
r128
radeon drm/radeon: fix si_enable_smc_cac() failed issue 2019-11-12 19:20:38 +01:00
rcar-du drm: rcar-du: add missing of_node_put 2019-04-05 22:33:10 +02:00
rockchip drm/rockchip: Suspend DP late 2019-08-29 08:28:40 +02:00
savage drm/savage: off by one in savage_bci_cmdbuf() 2018-07-04 14:27:01 +02:00
scheduler drm/scheduler: fix param documentation 2018-08-09 11:57:39 -05:00
selftests
shmobile drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
sis
sti drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
stm drm/stm: attach gem fence to atomic state 2019-10-07 18:56:31 +02:00
sun4i drm/sun4i: tcon: Set min division of TCON0_DCLK to 1. 2019-12-13 08:51:05 +01:00
tdfx
tegra drm/tegra: gem: Fix CPU-cache maintenance for BO's allocated using get_pages() 2019-06-09 09:17:22 +02:00
tilcdc drm/tilcdc: Register cpufreq notifier after we have initialized crtc 2019-09-06 10:22:03 +02:00
tinydrm tinydrm/mipi-dbi: Use dma-safe buffers for all SPI transfers 2019-05-31 06:46:32 -07:00
ttm drm/ttm: Restore ttm prefaulting 2019-10-29 09:19:54 +01:00
tve200
udl drm/udl: move to embedding drm device inside udl device. 2019-07-21 09:03:18 +02:00
v3d drm/v3d: Handle errors from IRQ setup. 2019-05-31 06:46:34 -07:00
vc4 drm/vc4: fix fb references in async update 2019-06-15 11:54:11 +02:00
vgem drm/vgem: fix use-after-free when drm_gem_handle_create() fails 2019-04-03 06:26:26 +02:00
via
virtio drm/virtio: Add memory barriers for capset cache. 2019-07-31 07:27:00 +02:00
vkms drm/vkms: Bugfix extra vblank frame 2019-04-05 22:33:12 +02:00
vmwgfx drm/vmwgfx: Fix double free in vmw_recv_msg() 2019-09-16 08:21:40 +02:00
xen
zte drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
ati_pcigart.c
drm_agpsupport.c
drm_atomic.c drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors 2019-09-16 08:22:23 +02:00
drm_atomic_helper.c drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors 2019-09-16 08:22:23 +02:00
drm_auth.c drm: set is_master to 0 upon drm_new_set_master() failure 2018-12-08 12:59:07 +01:00
drm_blend.c
drm_bridge.c
drm_bufs.c drm: return -EFAULT if copy_to_user() fails 2019-07-14 08:11:14 +02:00
drm_cache.c
drm_client.c drm/cma-helper: Fix crash in fbdev error path 2018-10-02 13:03:34 +02:00
drm_color_mgmt.c
drm_connector.c drm/connector: Fix typo in drm_connector_list_iter_next() 2018-07-16 13:18:09 -04:00
drm_context.c drm: re-enable error handling 2018-07-16 10:01:19 -04:00
drm_crtc.c drm/lease: Make sure implicit planes are leased 2019-06-09 09:17:23 +02:00
drm_crtc_helper.c
drm_crtc_helper_internal.h
drm_crtc_internal.h drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_debugfs.c drm/atomic: Use drm_drv_uses_atomic_modeset() for debugfs creation 2018-09-17 19:24:37 -04:00
drm_debugfs_crc.c drm/crc-debugfs: Also sprinkle irqrestore over early exits 2019-07-31 07:26:59 +02:00
drm_dma.c
drm_dp_aux_dev.c
drm_dp_cec.c drm_dp_cec.c: fix formatting typo: %pdH -> %phD 2018-07-28 15:50:40 -03:00
drm_dp_dual_mode_helper.c
drm_dp_helper.c drm/dp_helper: Add DP aux channel tracing 2018-07-16 11:47:53 -04:00
drm_dp_mst_topology.c drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers 2019-04-05 22:33:17 +02:00
drm_drv.c drm/drv: Hold ref on parent device during drm_device lifetime 2019-05-31 06:46:34 -07:00
drm_dumb_buffers.c drm-misc-next for 4.19: 2018-06-28 13:29:07 +10:00
drm_edid.c drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 2019-10-29 09:19:53 +01:00
drm_edid_load.c drm/edid: Fix a missing-check bug in drm_load_edid_firmware() 2019-07-31 07:26:58 +02:00
drm_encoder.c
drm_encoder_slave.c
drm_fb_cma_helper.c drm/cma-helper: Fix crash in fbdev error path 2018-10-02 13:03:34 +02:00
drm_fb_helper.c drm/fb-helper: generic: Don't take module ref for fbcon 2019-07-10 09:53:45 +02:00
drm_file.c drm: Wake up next in drm_read() chain if we are forced to putback the event 2019-05-31 06:46:34 -07:00
drm_flip_work.c
drm_fourcc.c drm/fourcc: Add is_yuv field to drm_format_info to denote if the format is yuv 2018-07-18 16:56:45 +01:00
drm_framebuffer.c drm: silence variable 'conn' set but not used 2019-08-16 10:12:46 +02:00
drm_gem.c drm/i915: Prevent writing into a read-only object via a GGTT mmap 2018-07-13 16:14:04 +01:00
drm_gem_cma_helper.c
drm_gem_framebuffer_helper.c
drm_global.c drm: add SPDX identifier and clarify license 2018-06-29 15:28:47 -05:00
drm_hashtab.c
drm_info.c
drm_internal.h drm/lease: Send a distinct uevent 2018-12-13 09:16:21 +01:00
drm_ioc32.c drm: add __user attribute to ptr_to_compat() 2019-09-16 08:22:08 +02:00
drm_ioctl.c drm/ioctl: Fix Spectre v1 vulnerabilities 2018-12-29 13:37:59 +01:00
drm_irq.c
drm_kms_helper_common.c
drm_lease.c drm: Use array_size() when creating lease 2019-02-20 10:25:49 +01:00
drm_legacy.h
drm_lock.c
drm_memory.c
drm_mipi_dsi.c drm: Add support for pps and compression mode command packet 2018-07-25 07:51:05 -04:00
drm_mm.c
drm_mode_config.c
drm_mode_object.c drm: Reorder set_property_atomic to avoid returning with an active ww_ctx 2019-03-27 14:14:42 +09:00
drm_modes.c drm/modes: Prevent division by zero htotal 2019-02-15 08:10:12 +01:00
drm_modeset_helper.c
drm_modeset_lock.c drm: Change deadlock-avoidance algorithm for the modeset locks. 2018-07-03 09:46:05 +02:00
drm_of.c drm/doc: Include drm_of.c helpers 2018-07-13 18:40:28 +02:00
drm_panel.c Revert "drm/panel: Add device_link from panel device to DRM device" 2018-09-27 11:00:42 -04:00
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC 2019-09-19 09:09:39 +02:00
drm_pci.c drm: drop drm_pcie_get_speed_cap_mask and drm_pcie_get_max_link_width 2018-07-05 16:40:00 -05:00
drm_plane.c drm/lease: Make sure implicit planes are leased 2019-06-09 09:17:23 +02:00
drm_plane_helper.c drm: add missing ctx argument to plane transitional helpers 2018-07-03 09:30:19 +02:00
drm_prime.c
drm_print.c drm: Add puts callback for the coredump printer 2018-07-30 08:49:41 -04:00
drm_probe_helper.c drm: Flush output polling on shutdown 2019-10-01 08:26:11 +02:00
drm_property.c drm: Use kvzalloc for allocating blob property memory 2018-07-02 11:05:21 -05:00
drm_rect.c
drm_scatter.c
drm_scdc_helper.c
drm_simple_kms_helper.c drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
drm_syncobj.c drm/syncobj: Don't leak fences when WAIT_FOR_SUBMIT is set 2018-09-26 10:39:14 -04:00
drm_sysfs.c drm/lease: Send a distinct uevent 2018-12-13 09:16:21 +01:00
drm_trace.h
drm_trace_points.c
drm_vblank.c drm/vblank: Allow dynamic per-crtc max_vblank_count 2019-09-16 08:22:04 +02:00
drm_vm.c
drm_vma_manager.c drm: add SPDX idenitifier and clarify license 2018-06-29 15:28:47 -05:00
drm_writeback.c drm: writeback: Fix doc that says connector should be disconnected 2018-07-16 16:35:27 +01:00
Kconfig drm/fb_helper: Allow leaking fbdev smem_start 2019-01-16 22:04:35 +01:00
Makefile drm: add support for DisplayPort CEC-Tunneling-over-AUX 2018-07-13 17:58:19 +03:00