1
0
Fork 0
alistair23-linux/drivers/gpu/drm
Matthew Wilcox 69ef943dbc drm: Use array_size() when creating lease
Passing an object_count of sufficient size will make
object_count * 4 wrap around to be very small, then a later function
will happily iterate off the end of the object_ids array.  Using
array_size() will saturate at SIZE_MAX, the kmalloc() will fail and
we'll return an -ENOMEM to the norty userspace.

Fixes: 62884cd386 ("drm: Add four ioctls for managing drm mode object leases [v7]")
Signed-off-by: Matthew Wilcox <willy@infradead.org>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: <stable@vger.kernel.org> # v4.15+
Signed-off-by: Dave Airlie <airlied@redhat.com>
2019-02-15 13:08:08 +10:00
..
amd drm/amdgpu/psp11: TA firmware is optional (v3) 2019-02-13 09:44:05 -05:00
arc drm: replace "drm_dev_unref" function with "drm_dev_put" 2018-11-24 22:12:54 +01:00
arm drm: mali-dp: Enable Mali-DP tiled buffer formats 2018-11-02 09:57:27 +00:00
armada Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
ast drm pull request for 4.21-rc1 2018-12-25 11:48:26 -08:00
atmel-hlcdc drm/atmel-hlcdc: Use drm_fbdev_generic_setup() 2018-11-01 15:24:22 +01:00
bochs Merge branch 'drm-next-4.21' of git://people.freedesktop.org/~agd5f/linux into drm-next 2018-11-19 11:07:52 +10:00
bridge drm/bridge: tc358767: use DP connector if no panel set 2019-01-09 10:49:31 +01:00
cirrus drm-misc-next for v4.21, part 2: 2018-11-22 12:54:38 +10:00
etnaviv Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
exynos drm/exynos: fimd: Make pixel blend mode configurable 2018-12-14 15:46:15 +09:00
fsl-dcu drm/fsl-dcu: Use drm_fbdev_generic_setup() 2018-11-01 15:23:58 +01:00
gma500 Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
hisilicon drm/ttm: initialize globals during device init (v2) 2018-11-05 14:21:21 -05:00
i2c Merge branch 'drm-tda9950-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes 2018-10-04 10:32:14 +10:00
i810
i915 drm/i915/opregion: rvda is relative from opregion base in opregion 2.1+ 2019-02-12 15:37:58 +02:00
imx drm/imx: imx-ldb: add missing of_node_puts 2019-01-17 14:59:02 +01:00
lib
mediatek drm/mediatek: Only try to attach bridge if there is one 2018-12-03 11:08:22 +08:00
meson drm/meson: Fix atomic mode switching regression 2019-01-15 13:21:32 +01:00
mga
mgag200 drm/ttm: initialize globals during device init (v2) 2018-11-05 14:21:21 -05:00
msm Merge tag 'drm-msm-fixes-2019-01-24' of git://people.freedesktop.org/~robclark/linux into drm-fixes 2019-01-25 07:45:00 +10:00
mxsfb drm: replace "drm_dev_unref" function with "drm_dev_put" 2018-11-24 22:12:54 +01:00
nouveau Merge branch 'linux-4.21' of git://github.com/skeggsb/linux into drm-fixes 2019-01-18 15:38:18 +10:00
omapdrm drm/omap: dsi: Hack-fix DSI bus flags 2019-02-06 13:39:03 +02:00
panel drm/panel: simple: Add AUO G101EVN010 panel support 2018-12-03 17:04:48 +01:00
pl111 drm/pl111: add of_node_put() 2018-11-28 09:31:07 -08:00
qxl drm/qxl: drop prime import/export callbacks 2019-01-14 08:16:18 +01:00
r128
radeon drm/radeon: check if device is root before getting pci speed caps 2019-01-29 10:57:02 -05:00
rcar-du drm pull request for 4.21-rc1 2018-12-25 11:48:26 -08:00
rockchip drm/rockchip: rgb: update SPDX license identifier 2019-01-25 14:50:07 +01:00
savage
scheduler drm/sched: Always trace the dependencies we wait on, to fix a race. 2019-02-08 14:02:33 -05:00
selftests drm/selftest: fix spelling mistake "dimention" -> "dimension" 2018-12-11 15:19:42 +01:00
shmobile drm: replace "drm_dev_unref" function with "drm_dev_put" 2018-11-24 22:12:54 +01:00
sis
sti drm/sti: remove set but not used variable 'priv' 2018-11-13 12:07:18 +01:00
stm drm/stm: Use drm_fbdev_generic_setup() 2018-10-25 17:00:28 +02:00
sun4i drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init 2019-02-01 14:10:51 +01:00
tdfx
tegra drm/tegra: sor: Reset the SOR if possible 2018-12-06 18:58:32 +01:00
tilcdc drm/tilcdc: Use drm_fbdev_generic_setup() 2018-11-01 15:25:41 +01:00
tinydrm drm/tinydrm: Use kmemdup rather than duplicating its implementation in repaper_spi_transfer() 2018-12-04 15:57:42 +01:00
ttm drm/ttm: Use drm_debug_printer for all ttm_bo_mem_space_debug output 2018-12-21 15:27:58 -05:00
tve200 drm: replace "drm_dev_unref" function with "drm_dev_put" 2018-11-24 22:12:54 +01:00
udl DRM: UDL: get rid of useless vblank initialization 2018-10-23 15:59:01 +02:00
v3d Final changes to drm-misc-next for v4.21: 2018-12-07 11:23:05 +10:00
vc4 drm: revert "expand replace_fence to support timeline point v2" 2018-12-05 11:01:11 +01:00
vgem drm/vgem: Fix typo in driver feature flags 2018-11-05 15:31:51 +00:00
via
virtio drm/virtio: drop prime import/export callbacks 2019-01-14 08:16:19 +01:00
vkms drm/vkms: Fix license inconsistent 2019-02-10 10:23:06 -02:00
vmwgfx drm/vmwgfx: Improve on IOMMU detection 2019-02-05 13:55:16 +01:00
xen drm/xen-front: Use Xen common shared buffer implementation 2018-12-18 12:16:13 -05:00
zte drm/zte: Use drm_atomic_helper_shutdown 2018-10-05 18:04:10 +02:00
Kconfig drm/fb_helper: Allow leaking fbdev smem_start 2018-10-03 21:08:21 +02:00
Makefile Merge tag 'vmwgfx-next-2018-12-05' of git://people.freedesktop.org/~thomash/linux into drm-next 2018-12-06 13:43:56 +10:00
ati_pcigart.c
drm_agpsupport.c
drm_atomic.c drm: Add a new plane property to send damage during plane update 2018-12-05 10:00:35 +01:00
drm_atomic_helper.c Final changes to drm-misc-next for v4.21: 2018-12-07 11:23:05 +10:00
drm_atomic_state_helper.c drm: Put damage blob when destroy plane state 2018-12-24 11:53:50 +01:00
drm_atomic_uapi.c gpu/drm: Fix lock held when returning to user space. 2019-01-10 11:31:58 +01:00
drm_auth.c drm: set is_master to 0 upon drm_new_set_master() failure 2018-11-26 16:14:27 -05:00
drm_blend.c drm: Clarify DRM_MODE_REFLECT_X/Y documentation 2018-09-11 11:21:30 +01:00
drm_bridge.c drm: bridge: document bridge attach/detach imbalance 2018-09-13 11:28:12 +02:00
drm_bufs.c drm/bufs: Fix Spectre v1 vulnerability 2018-10-17 09:17:33 +02:00
drm_cache.c
drm_client.c drm/gem: Add drm_gem_object_funcs 2018-11-20 14:56:18 +01:00
drm_color_mgmt.c drm: Add DRM_MODESET_LOCK_BEGIN/END helpers 2018-11-29 10:48:31 -05:00
drm_connector.c Merge branch 'drm-next-4.21' of git://people.freedesktop.org/~agd5f/linux into drm-next 2018-12-06 13:29:09 +10:00
drm_context.c drm: Differentiate the lack of an interface from invalid parameter 2018-09-14 17:29:47 +01:00
drm_crtc.c Final changes to drm-misc-next for v4.21: 2018-12-07 11:23:05 +10:00
drm_crtc_helper.c drm: Remove transitional helpers 2018-10-05 18:04:10 +02:00
drm_crtc_helper_internal.h
drm_crtc_internal.h drm: refuse ADDFB2 ioctl for broken bigendian drivers 2018-09-10 07:10:36 +02:00
drm_damage_helper.c drm: fix null pointer dereference on null state pointer 2018-12-24 11:52:43 +01:00
drm_debugfs.c drm: Merge drm_info.c into drm_debugfs.c 2018-11-22 09:52:27 +01:00
drm_debugfs_crc.c Revert "drm: crc: Wait for a frame before returning from open()" 2018-08-22 09:50:16 -07:00
drm_dma.c
drm_dp_aux_dev.c
drm_dp_cec.c drm: Do not call drm_dp_cec_set_edid() while registering DP connectors 2018-10-11 10:52:35 +02:00
drm_dp_dual_mode_helper.c
drm_dp_helper.c drm/i915: Disable PSR in Apple panels 2019-01-10 15:09:35 +02:00
drm_dp_mst_topology.c Revert "drm/dp_mst: Skip validating ports during destruction, just ref" 2018-11-28 16:22:17 -05:00
drm_drv.c drm-misc-next for v4.21: 2018-11-29 10:28:49 +10:00
drm_dsc.c drm/dsc: Add helpers for DSC picture parameter set infoframes 2018-11-27 18:35:17 -08:00
drm_dumb_buffers.c
drm_edid.c drm, i915, amdgpu, bridge + core quirk 2018-11-02 10:58:20 -07:00
drm_edid_load.c
drm_encoder.c drm: Differentiate the lack of an interface from invalid parameter 2018-09-14 17:29:47 +01:00
drm_encoder_slave.c
drm_fb_cma_helper.c drm-misc-next for v4.21, part 1: 2018-11-19 10:40:33 +10:00
drm_fb_helper.c drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock 2019-01-10 08:25:36 +01:00
drm_file.c Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
drm_flip_work.c
drm_fourcc.c drm: Introduce new DRM_FORMAT_XYUV 2018-11-20 16:20:13 +02:00
drm_framebuffer.c drm: Add macro to export functions only when CONFIG_DRM_DEBUG_SELFTEST is enabled 2018-11-02 09:58:10 +00:00
drm_gem.c drm/gem: Add drm_gem_object_funcs 2018-11-20 14:56:18 +01:00
drm_gem_cma_helper.c drm/cma-helper: Add DRM_GEM_CMA_VMAP_DRIVER_OPS 2018-11-20 14:57:25 +01:00
drm_gem_framebuffer_helper.c drm/fourcc: Add char_per_block, block_w and block_h in drm_format_info 2018-11-02 09:55:27 +00:00
drm_hashtab.c
drm_internal.h drm pull request for 4.21-rc1 2018-12-25 11:48:26 -08:00
drm_ioc32.c
drm_ioctl.c drm/ioctl: Fix Spectre v1 vulnerabilities 2018-12-20 08:13:29 +01:00
drm_irq.c drm: Differentiate the lack of an interface from invalid parameter 2018-09-14 17:29:47 +01:00
drm_kms_helper_common.c
drm_lease.c drm: Use array_size() when creating lease 2019-02-15 13:08:08 +10:00
drm_legacy.h
drm_lock.c drm: Differentiate the lack of an interface from invalid parameter 2018-09-14 17:29:47 +01:00
drm_memory.c drm: Shift * to be adjacent to pointer name 2018-10-16 14:39:25 +02:00
drm_mipi_dsi.c drm: Add support for pps and compression mode command packet 2018-07-25 07:51:05 -04:00
drm_mm.c
drm_mode_config.c Merge tag 'vmwgfx-next-2018-12-05' of git://people.freedesktop.org/~thomash/linux into drm-next 2018-12-06 13:43:56 +10:00
drm_mode_object.c gpu/drm: Fix lock held when returning to user space. 2019-01-10 11:31:58 +01:00
drm_modes.c drm/modes: Prevent division by zero htotal 2019-01-24 13:04:14 +01:00
drm_modeset_helper.c drm: Unexport primary plane helpers 2018-10-05 18:06:49 +02:00
drm_modeset_lock.c drm: Add DRM_MODESET_LOCK_BEGIN/END helpers 2018-11-29 10:48:31 -05:00
drm_of.c drm/doc: Include drm_of.c helpers 2018-07-13 18:40:28 +02:00
drm_panel.c This is the 4.19-rc6 release 2018-10-04 11:03:34 +10:00
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Do rotation quirk for new GPD Win2 FW 2018-11-15 10:55:30 +01:00
drm_pci.c cross-tree: phase out dma_zalloc_coherent() 2019-01-08 07:58:37 -05:00
drm_plane.c drm: Add DRM_MODESET_LOCK_BEGIN/END helpers 2018-11-29 10:48:31 -05:00
drm_plane_helper.c drm: Unexport drm_plane_helper_check_update 2018-10-05 22:45:19 +02:00
drm_prime.c drm/prime: Fix drm_gem_prime_mmap() stack use 2018-11-22 15:44:05 +01:00
drm_print.c drm: Add puts callback for the coredump printer 2018-07-30 08:49:41 -04:00
drm_probe_helper.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_property.c drm: Differentiate the lack of an interface from invalid parameter 2018-09-14 17:29:47 +01:00
drm_rect.c
drm_scatter.c drm: Differentiate the lack of an interface from invalid parameter 2018-09-14 17:29:47 +01:00
drm_scdc_helper.c
drm_simple_kms_helper.c drm/tinydrm: Advertise that we can do only DRM_FORMAT_MOD_LINEAR. 2018-10-30 13:01:50 -07:00
drm_syncobj.c drm: revert "expand replace_fence to support timeline point v2" 2018-12-05 11:01:11 +01:00
drm_sysfs.c drm/lease: Send a distinct uevent 2018-11-30 10:57:18 +01:00
drm_trace.h
drm_trace_points.c
drm_vblank.c drm: Differentiate the lack of an interface from invalid parameter 2018-09-14 17:29:47 +01:00
drm_vm.c
drm_vma_manager.c drm: Remove "protection" around drm_vma_offset_manager_destroy() 2018-09-04 19:00:32 +01:00
drm_writeback.c drm: writeback: Fix doc that says connector should be disconnected 2018-07-16 16:35:27 +01:00