linux-uconsole/drivers
Dan Carpenter 9a0511abab drm/i810: Prevent underflow in ioctl
commit 4f69851fba upstream.

The "used" variables here come from the user in the ioctl and it can be
negative.  It could result in an out of bounds write.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-13 08:52:44 +01:00
..
accessibility
acpi ACPI / APEI: Switch estatus pool to use vmalloc memory 2019-12-05 09:21:20 +01:00
amba
android android: binder: no outgoing transaction when thread todo has transaction 2019-11-20 18:46:42 +01:00
ata ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs 2019-12-05 09:21:06 +01:00
atm atm: zatm: Fix empty body Clang warnings 2019-12-01 09:16:41 +01:00
auxdisplay auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach 2019-09-06 10:21:56 +02:00
base drivers/base/platform.c: kmemleak ignore a known leak 2019-12-05 09:21:04 +01:00
bcma
block rsxx: add missed destroy_workqueue calls in remove 2019-12-13 08:51:06 +01:00
bluetooth Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading 2019-12-05 09:20:39 +01:00
bus bus: ti-sysc: Fix getting optional clocks in clock_roles 2019-12-13 08:51:23 +01:00
cdrom cdrom: don't attempt to fiddle with cdo->capability 2019-12-01 09:16:20 +01:00
char lp: fix sparc64 LPSETTIMEOUT ioctl 2019-12-13 08:50:58 +01:00
clk clk: renesas: rcar-gen3: Set state when registering SD clocks 2019-12-13 08:52:32 +01:00
clocksource clocksource/drivers/fttmr010: Fix invalid interrupt register access 2019-12-05 09:20:38 +01:00
connector
cpufreq cpufreq: Add NULL checks to show() and store() methods of cpufreq 2019-12-01 09:17:39 +01:00
cpuidle cpuidle: menu: Fix wakeup statistics updates for polling state 2019-11-24 08:20:07 +01:00
crypto crypto: bcm - fix normal/non key hash algorithm failure 2019-12-13 08:51:25 +01:00
dax
dca
devfreq PM / devfreq: Fix kernel oops on governor module load 2019-12-01 09:17:46 +01:00
dio
dma dmaengine: dw-dmac: implement dma protection control setting 2019-12-13 08:51:43 +01:00
dma-buf dma-buf/sw_sync: Synchronize signal vs syncpt free 2019-10-07 18:57:04 +02:00
edac EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() 2019-12-01 09:16:18 +01:00
eisa
extcon extcon: max8997: Fix lack of path setting in USB device mode 2019-12-13 08:51:15 +01:00
firewire
firmware firmware: raspberrypi: Fix firmware calls with large buffers 2019-12-13 08:51:26 +01:00
fmc
fpga fpga: altera-ps-spi: Fix getting of optional confd gpio 2019-09-21 07:16:53 +02:00
fsi fsi: scom: Don't abort operations for minor errors 2019-09-06 10:22:19 +02:00
gnss
gpio gpio: raspberrypi-exp: decrease refcount on firmware dt node 2019-12-05 09:20:24 +01:00
gpu drm/i810: Prevent underflow in ioctl 2019-12-13 08:52:44 +01:00
hid HID: core: check whether Usage Page item is after Usage ID items 2019-12-05 09:21:34 +01:00
hsi
hv vmbus: keep pointer to ring buffer page 2019-11-20 18:47:31 +01:00
hwmon hwmon: (npcm-750-pwm-fan) Change initial pwm target to 255 2019-11-24 08:21:01 +01:00
hwspinlock
hwtracing coresight: etm4x: Fix input validation for sysfs. 2019-12-13 08:52:39 +01:00
i2c i2c: imx: don't print error message on probe defer 2019-12-13 08:51:57 +01:00
ide
idle
iio iio: dac: mcp4922: fix error handling in mcp4922_write_raw 2019-11-20 18:45:21 +01:00
infiniband mlx4: Use snprintf instead of complicated strcpy 2019-12-13 08:52:31 +01:00
input Input: Fix memory leak in psxpad_spi_probe 2019-12-13 08:52:40 +01:00
iommu iommu/amd: Fix line-break in error log reporting 2019-12-13 08:52:00 +01:00
ipack
irqchip irqchip/irq-mvebu-icu: Fix wrong private data retrieval 2019-11-24 08:19:40 +01:00
isdn mISDN: Fix type of switch control variable in ctrl_teimanager 2019-12-01 09:16:55 +01:00
leds led: triggers: Fix a memory leak bug 2019-10-05 13:09:45 +02:00
lightnvm lightnvm: pblk: consider max hw sectors supported for max_write_pgs 2019-11-24 08:20:52 +01:00
macintosh macintosh/windfarm_smu_sat: Fix debug output 2019-12-01 09:16:37 +01:00
mailbox mailbox: mailbox-test: fix null pointer if no mmio 2019-12-05 09:21:35 +01:00
mcb
md dm raid: fix false -EBUSY when handling check/repair message 2019-12-05 09:20:37 +01:00
media media: vimc: fix start stream when link is disabled 2019-12-13 08:52:34 +01:00
memory memory: omap-gpmc: Get the header of the enum 2019-12-05 09:20:29 +01:00
memstick memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' 2019-10-29 09:20:07 +01:00
message
mfd mfd: max8997: Enale irq-wakeup unconditionally 2019-12-01 09:16:57 +01:00
misc altera-stapl: check for a null key before strcasecmp'ing it 2019-12-13 08:51:56 +01:00
mmc mmc: core: align max segment size with logical block size 2019-12-05 09:21:13 +01:00
mtd mtd: spi-nor: cast to u64 to avoid uint overflows 2019-12-05 09:21:33 +01:00
mux
net can: slcan: Fix use-after-free Read in slcan_open 2019-12-13 08:52:43 +01:00
nfc NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error 2019-12-13 08:51:03 +01:00
ntb ntb: intel: fix return value for ndev_vec_mask() 2019-12-01 09:17:13 +01:00
nubus
nvdimm libnvdimm/region: Initialize bad block for volatile namespaces 2019-10-11 18:21:20 +02:00
nvme nvme: Free ctrl device name on init failure 2019-12-13 08:51:53 +01:00
nvmem nvmem: core: return error code instead of NULL from nvmem_device_get 2019-11-20 18:46:31 +01:00
of of: unittest: initialize args before calling of_*parse_*() 2019-12-01 09:17:30 +01:00
opp OPP: Return error on error from dev_pm_opp_get_opp_count() 2019-11-24 08:20:06 +01:00
oprofile
parisc parisc: Disable HP HSC-PCI Cards to prevent kernel crash 2019-10-05 13:10:04 +02:00
parport
pci PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() 2019-12-05 09:21:06 +01:00
pcmcia
perf drivers/perf: arm_pmu: Fix failure path in PM notifier 2019-08-06 19:06:55 +02:00
phy phy: lantiq: Fix compile warning 2019-11-20 18:47:35 +01:00
pinctrl pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues 2019-12-13 08:51:26 +01:00
platform platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size 2019-12-05 09:21:35 +01:00
pnp
power PM / AVS: SmartReflex: NULL check before some freeing functions is not needed 2019-12-05 09:20:02 +01:00
powercap
pps drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl 2019-08-04 09:30:56 +02:00
ps3
ptp
pwm pwm: Clear chip_data in pwm_put() 2019-12-05 09:21:29 +01:00
rapidio drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings 2019-08-06 19:06:52 +02:00
ras RAS/CEC: Fix pfn insertion 2019-07-26 09:14:05 +02:00
regulator regulator: tps65910: fix a missing check of return value 2019-12-05 09:20:46 +01:00
remoteproc remoteproc: qcom: q6v5: Fix a race condition on fatal crash 2019-11-24 08:20:29 +01:00
reset reset: Fix memory leak in reset_control_array_put() 2019-12-05 09:19:36 +01:00
rpmsg rpmsg: glink: smem: Support rx peak for size less than 4 bytes 2019-11-24 08:20:05 +01:00
rtc rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()' 2019-12-13 08:51:35 +01:00
s390 scsi: zfcp: drop default switch case which might paper over missing case 2019-12-13 08:51:22 +01:00
sbus
scsi scsi: libsas: Check SMP PHY control function result 2019-12-05 09:21:21 +01:00
sfi
sh
siox
slimbus slimbus: ngd: Fix build error on x86 2019-12-13 08:51:54 +01:00
sn
soc soc: renesas: r8a77990-sysc: Fix initialization order of 3DG-{A,B} 2019-12-13 08:52:29 +01:00
soundwire soundwire: intel: Fix uninitialized adev deref 2019-11-20 18:45:22 +01:00
spi spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch 2019-12-01 09:17:33 +01:00
spmi
ssb
staging Staging: iio: adt7316: Fix i2c data reading, set the data field 2019-12-13 08:51:26 +01:00
target scsi: target/tcmu: Fix queue_cmd_ring() declaration 2019-12-05 09:19:47 +01:00
tc
tee tee: optee: add missing of_node_put after of_device_is_available 2019-11-24 08:19:08 +01:00
thermal thermal: rcar_thermal: Prevent hardware access during system suspend 2019-12-01 09:17:00 +01:00
thunderbolt thunderbolt: Power cycle the router if NVM authentication fails 2019-12-05 09:21:27 +01:00
tty tty: vt: keyboard: reject invalid keycodes 2019-12-13 08:52:43 +01:00
uio vmbus: keep pointer to ring buffer page 2019-11-20 18:47:31 +01:00
usb usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler 2019-12-13 08:52:32 +01:00
uwb
vfio vfio/spapr_tce: Get rid of possible infinite loop 2019-12-05 09:20:43 +01:00
vhost vhost/vsock: split packets to send using multiple buffers 2019-12-01 09:16:08 +01:00
video backlight: lm3639: Unconditionally call led_classdev_unregister 2019-11-24 08:20:45 +01:00
virt virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr 2019-11-06 13:06:04 +01:00
virtio virtio_ring: fix return code on DMA mapping fails 2019-12-01 09:17:40 +01:00
visorbus
vlynq
vme
w1 w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size). 2019-12-01 09:16:22 +01:00
watchdog watchdog: sama5d4: fix WDD value to be always set to max 2019-12-05 09:21:32 +01:00
xen xen/pciback: Check dev_data before using it 2019-12-05 09:20:26 +01:00
zorro
Kconfig
Makefile