i/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4abe275c2deeab918601ce6f520cf514b8738607
linux/drivers/gpu/drm
T
History
Dan Carpenter 08a7525811 drm/vmwgfx: Potential off by one in vmw_view_add() 
commit 0d9cac0ca0429830c40fe1a4e50e60f6221fd7b6 upstream.

The vmw_view_cmd_to_type() function returns vmw_view_max (3) on error.
It's one element beyond the end of the vmw_view_cotables[] table.

My read on this is that it's possible to hit this failure.  header->id
comes from vmw_cmd_check() and it's a user controlled number between
1040 and 1225 so we can hit that error.  But I don't have the hardware
to test this code.

Fixes: d80efd5cb3 ("drm/vmwgfx: Initial DX support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-01-17 09:38:54 +01:00
..
amd
drm: amd: remove broken include path
2017-12-20 10:07:21 +01:00
arc
drm/arcpgu: Accommodate adv7511 switch to DRM bridge
2016-11-11 04:31:35 +03:00
arm
drm: mali-dp: fix Lx_CONTROL register fields clobber
2017-11-15 15:53:13 +01:00
armada
Revert "drm/armada: Fix compile fail"
2017-12-14 09:28:16 +01:00
ast
drm/ast: Handle configuration without P2A bridge
2017-07-05 14:40:17 +02:00
atmel-hlcdc
Merge tag 'v4.8-rc8' into drm-next
2016-09-28 12:08:49 +10:00
bochs
Merge tag 'drm-qemu-20160921' of git://git.kraxel.org/linux into drm-next
2016-09-28 13:23:07 +10:00
bridge
drm/bridge: adv7511: Re-write the i2c address before EDID probing
2017-11-15 15:53:20 +01:00
cirrus
drm/drivers: add support for using the arch wc mapping API.
2016-10-26 16:48:01 +10:00
etnaviv
etnaviv: fix gem object list corruption
2017-10-05 09:44:03 +02:00
exynos
drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
2017-12-14 09:28:14 +01:00
fsl-dcu
drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume()
2017-12-09 22:01:46 +01:00
gma500
drm/gma500/psb: Actually use VBT mode when it is found
2017-06-07 12:07:49 +02:00
hisilicon
drm/hisilicon: Ensure LDI regs are properly configured.
2017-12-05 11:24:35 +01:00
i2c
Revert "drm/i2c: tda998x: don't register the connector"
2016-09-23 03:29:50 -07:00
i810
…
i915
drm/i915: Prevent zero length "index" write
2017-12-05 11:24:35 +01:00
imx
drm/imx: imx-tve: Do not set the regulator voltage
2017-03-15 10:02:50 +08:00
mediatek
drm/mediatek: don't use drm_put_dev
2017-11-30 08:39:13 +00:00
mga
drm/mga: remove device_is_agp callback
2017-04-12 12:41:20 +02:00
mgag200
gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap
2017-11-21 09:23:26 +01:00
msm
drm/msm: fix an integer overflow test
2017-11-08 10:08:32 +01:00
nouveau
drm/nouveau/mmu: flush tlbs before deleting page tables
2017-10-27 10:38:07 +02:00
omapdrm
drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
2017-12-20 10:07:20 +01:00
panel
drm/panel: simple: Add missing panel_simple_unprepare() calls
2017-12-05 11:24:34 +01:00
qxl
Merge tag 'drm-qemu-20160921' of git://git.kraxel.org/linux into drm-next
2016-09-28 13:23:07 +10:00
r128
…
radeon
drm/radeon: reinstate oland workaround for sclk
2017-12-20 10:07:23 +01:00
rcar-du
drm: rcar-du: Fix H/V sync signal polarity configuration
2017-08-30 10:21:48 +02:00
rockchip
drm/rockchip: analogix_dp: Refuse to enable PSR if panel doesn't support it
2016-10-04 08:23:17 +02:00
savage
drm/savage: dereferencing an error pointer
2017-01-19 20:17:58 +01:00
shmobile
…
sis
…
sti
drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache
2017-11-21 09:23:23 +01:00
sun4i
drm/sun4i: Fix a return value in case of error
2017-11-30 08:39:10 +00:00
tdfx
…
tegra
drm/tegra: dpaux: Fix error handling
2017-01-19 20:17:58 +01:00
tilcdc
Merge tag 'tilcdc-4.9-3.1' of https://github.com/jsarha/linux into drm-next
2016-09-28 11:17:26 +10:00
ttm
drm/ttm: once more fix ttm_buffer_object_transfer
2017-12-05 11:24:35 +01:00
udl
drm/udl: make control msg static const. (v2)
2016-11-11 08:57:34 +10:00
vc4
drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
2017-06-24 07:11:14 +02:00
vgem
drm: Don't swallow error codes in drm_dev_alloc()
2016-09-22 04:03:48 -07:00
via
mm: replace get_user_pages() write/force parameters with gup_flags
2016-10-19 08:11:43 -07:00
virtio
drm/virtio: fix framebuffer sparse warning
2017-08-11 08:49:35 -07:00
vmwgfx
drm/vmwgfx: Potential off by one in vmw_view_add()
2018-01-17 09:38:54 +01:00
ati_pcigart.c
…
drm_agpsupport.c
…
drm_atomic_helper.c
drm: reference count event->completion
2017-03-30 09:41:28 +02:00
drm_atomic.c
drm/atomic: If the atomic check fails, return its value first
2017-08-30 10:21:48 +02:00
drm_auth.c
…
drm_blend.c
drm/doc: Polish plane composition property docs
2016-09-22 00:04:02 -07:00
drm_bridge.c
drm: Extract drm_bridge.h
2016-09-19 15:04:15 +02:00
drm_bufs.c
GPU-DRM: Replace a kzalloc() call by kcalloc() in drm_legacy_addbufs_sg()
2016-09-21 13:24:27 +02:00
drm_cache.c
…
drm_color_mgmt.c
drm/doc: Document color space handling
2016-09-22 00:04:03 -07:00
drm_connector.c
drm: Don't race connector registration
2017-06-17 06:41:53 +02:00
drm_context.c
…
drm_crtc_helper_internal.h
drm/fb-helper: Fix sparse warnings
2016-09-19 16:45:15 +02:00
drm_crtc_helper.c
…
drm_crtc_internal.h
drm: Extract drm_color_mgmt.[hc]
2016-09-22 00:04:02 -07:00
drm_crtc.c
drm: Extract drm_color_mgmt.[hc]
2016-09-22 00:04:02 -07:00
drm_debugfs.c
…
drm_dma.c
…
drm_dp_aux_dev.c
…
drm_dp_dual_mode_helper.c
…
drm_dp_helper.c
Merge tag 'drm-for-v4.9' of git://people.freedesktop.org/~airlied/linux
2016-10-11 18:12:22 -07:00
drm_dp_mst_topology.c
drm/mst: Avoid processing partially received up/down message transactions
2017-07-27 15:08:07 -07:00
drm_drv.c
drm: drm_minor_register(): Clean up debugfs on failure
2017-11-15 15:53:12 +01:00
drm_edid_load.c
…
drm_edid.c
drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
2017-05-25 15:44:48 +02:00
drm_encoder_slave.c
…
drm_encoder.c
drm: Fix typo in encoder docs
2016-09-21 13:33:50 +02:00
drm_fb_cma_helper.c
…
drm_fb_helper.c
drm: Cancel drm_fb_helper_resume_work on unload
2017-03-15 10:02:50 +08:00
drm_flip_work.c
…
drm_fops.c
drm: reference count event->completion
2017-03-30 09:41:28 +02:00
drm_fourcc.c
…
drm_framebuffer.c
drm: Extract drm_plane.[hc]
2016-09-22 00:01:56 -07:00
drm_gem_cma_helper.c
…
drm_gem.c
drm: Release driver tracking before making the object available again
2017-08-30 10:21:47 +02:00
drm_global.c
drm: modify drm_global_item_ref to avoid two times of writing ref->object
2016-09-14 15:10:29 -04:00
drm_hashtab.c
…
drm_info.c
drm: Print device information again in debugfs
2016-10-17 16:20:53 +10:00
drm_internal.h
drm: drop obsolete drm_core.h
2016-09-19 13:57:38 +02:00
drm_ioc32.c
drm: drop obsolete drm_core.h
2016-09-19 13:57:38 +02:00
drm_ioctl.c
drm: Don't call drm_for_each_crtc with a non-KMS driver
2016-11-30 10:13:00 +01:00
drm_irq.c
drm: avoid uninitialized timestamp use in wait_vblank
2017-01-19 20:18:06 +01:00
drm_kms_helper_common.c
…
drm_legacy.h
…
drm_lock.c
…
drm_memory.c
…
drm_mipi_dsi.c
…
drm_mm.c
drm: Apply range restriction after color adjustment when allocation
2017-11-30 08:39:13 +00:00
drm_mode_object.c
drm: Move property validation to a helper, v2.
2016-09-12 10:32:49 -04:00
drm_modes.c
drm: Fix broken VT switch with video=1366x768 option
2017-02-01 08:33:02 +01:00
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_of.c
…
drm_panel.c
…
drm_pci.c
drm: Don't swallow error codes in drm_dev_alloc()
2016-09-22 04:03:48 -07:00
drm_plane_helper.c
…
drm_plane.c
drm: Undo damage to page_flip_ioctl
2016-10-04 12:53:12 +10:00
drm_platform.c
drm: Don't swallow error codes in drm_dev_alloc()
2016-09-22 04:03:48 -07:00
drm_prime.c
drm: Fix up kerneldoc for new drm_gem_dmabuf_export()
2016-10-10 11:19:42 +02:00
drm_probe_helper.c
drm: Schedule the output_poll_work with 1s delay if we have delayed event
2017-02-01 08:33:02 +01:00
drm_property.c
…
drm_rect.c
…
drm_scatter.c
…
drm_simple_kms_helper.c
drm: simple_kms_helper: Add prepare_fb and cleanup_fb hooks
2016-10-05 15:18:02 +02:00
drm_sysfs.c
drm: drop obsolete drm_core.h
2016-09-19 13:57:38 +02:00
drm_trace_points.c
…
drm_trace.h
…
drm_vm.c
…
drm_vma_manager.c
drm: use drm_file to tag vm-bos
2016-09-19 11:22:08 +02:00
Kconfig
…
Makefile
drm: Extract drm_color_mgmt.[hc]
2016-09-22 00:04:02 -07:00