kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Guenter Roeck a333c5c524 drm/i915/backlight: Return immediately when scale() finds invalid parameters 
commit 6f71507415 upstream.

The scale() functions detects invalid parameters, but continues
its calculations anyway. This causes bad results if negative values
are used for unsigned operations. Worst case, a division by 0 error
will be seen if source_min == source_max.

On top of that, after v6.13, the sequence of WARN_ON() followed by clamp()
may result in a build error with gcc 13.x.

drivers/gpu/drm/i915/display/intel_backlight.c: In function 'scale':
include/linux/compiler_types.h:542:45: error:
	call to '__compiletime_assert_415' declared with attribute error:
	clamp() low limit source_min greater than high limit source_max

This happens if the compiler decides to rearrange the code as follows.

        if (source_min > source_max) {
                WARN(..);
                /* Do the clamp() knowing that source_min > source_max */
                source_val = clamp(source_val, source_min, source_max);
        } else {
                /* Do the clamp knowing that source_min <= source_max */
                source_val = clamp(source_val, source_min, source_max);
        }

Fix the problem by evaluating the return values from WARN_ON and returning
immediately after a warning. While at it, fix divide by zero error seen
if source_min == source_max.

Analyzed-by: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Suggested-by: David Laight <david.laight.linux@gmail.com>
Cc: David Laight <david.laight.linux@gmail.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250121145203.2851237-1-linux@roeck-us.net
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-02 13:40:43 +02:00
..
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:02:55 +02:00
acpi ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() 2025-09-09 18:54:16 +02:00
amba amba: bus: fix refcount leak 2023-09-13 09:42:56 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:10:26 +02:00
ata ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig 2025-08-28 16:26:12 +02:00
atm atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). 2025-09-04 15:26:27 +02:00
auxdisplay auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" 2025-06-04 14:40:07 +02:00
base x86/vmscape: Enable the mitigation 2025-09-11 17:19:15 +02:00
bcma Interrupt subsystem updates: 2022-10-12 10:23:24 -07:00
block drbd: add missing kref_get in handle_write_conflicts 2025-08-28 16:25:51 +02:00
bluetooth Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID 2025-07-24 08:51:52 +02:00
bus bus: mhi: host: Detect events pointing to unexpected TREs 2025-08-28 16:26:05 +02:00
cdrom cdrom: rearrange last_media_change check to avoid unintentional overflow 2024-07-11 12:47:10 +02:00
char ipmi: Fix strcpy source and destination the same 2025-08-28 16:26:02 +02:00
clk clk: sunxi-ng: v3s: Fix de clock definition 2025-08-15 12:05:03 +02:00
clocksource clocksource: mips-gic-timer: Enable counter when CPUs start 2025-06-04 14:40:12 +02:00
comedi comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() 2025-08-28 16:26:14 +02:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter counter: interrupt-cnt: Protect enable/disable OPs with mutex 2025-06-27 11:07:16 +01:00
cpufreq cpufreq: Initialize cpufreq-based invariance before subsys 2025-10-02 13:40:37 +02:00
cpuidle cpuidle: menu: Avoid discarding useful information 2025-06-04 14:40:11 +02:00
crypto crypto: qat - fix ring to service map for QAT GEN4 2025-08-28 16:26:12 +02:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 13:52:53 +01:00
dax dax: delete a stale directory pmem 2024-12-14 19:53:41 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-28 16:25:52 +02:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-12-31 13:32:38 +01:00
dma dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate 2025-09-19 16:29:59 +02:00
dma-buf dma-buf: fix timeout handling in dma_resv_wait_timeout v2 2025-07-10 15:59:53 +02:00
edac minmax: add a few more MIN_T/MAX_T users 2025-10-02 13:40:43 +02:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:03:41 +02:00
firewire firewire: nosy: ensure user_length is taken into account when fetching packet contents 2024-05-17 11:56:16 +02:00
firmware firmware: arm_scmi: Ensure that the message-id supports fastchannel 2025-07-06 10:58:04 +02:00
fpga fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() 2025-08-28 16:26:14 +02:00
fsi fsi: aspeed: Reset master errors after CFAM reset 2023-09-13 09:42:54 +02:00
gnss gnss: replace ida_simple API 2022-06-21 09:30:36 +02:00
gpio gpio: tps65912: check the return value of regmap_update_bits() 2025-08-28 16:25:53 +02:00
gpu drm/i915/backlight: Return immediately when scale() finds invalid parameters 2025-10-02 13:40:43 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:36:00 +02:00
hid HID: mcp2221: Handle reads greater than 60 bytes 2025-09-04 15:26:31 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-04-25 10:43:47 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:51:58 +01:00
hv Drivers: hv: vmbus: Add utility function for querying ring size 2025-07-06 10:57:58 +02:00
hwmon minmax: make generic MIN() and MAX() macros available everywhere 2025-10-02 13:40:43 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:53:09 +02:00
hwtracing coresight: Only check bottom two claim bits 2025-07-06 10:57:55 +02:00
i2c i2c: designware: Fix an error handling path in i2c_dw_pci_probe() 2025-09-09 18:54:19 +02:00
i3c i3c: master: Initialize ret in i3c_i2c_notifier_call() 2025-08-28 16:26:01 +02:00
idle cpuidle, intel_idle: Fix CPUIDLE_FLAG_IBRS 2025-03-13 12:53:11 +01:00
iio iio: light: opt3001: fix deadlock due to concurrent flag access 2025-09-09 18:54:19 +02:00
infiniband IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions 2025-10-02 13:40:37 +02:00
input Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table 2025-09-19 16:29:57 +02:00
interconnect interconnect: qcom: sc8180x: specify num_nodes 2025-08-15 12:04:55 +02:00
iommu iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() 2025-09-25 10:58:52 +02:00
ipack Char/Misc and other driver changes for 6.1-rc1 2022-10-08 08:56:37 -07:00
irqchip irqchip: Build IMX_MU_MSI only on ARM 2025-08-15 12:05:10 +02:00
isdn mISDN: Fix memory leak in dsp_hwec_enable() 2025-09-09 18:54:14 +02:00
leds leds: leds-lp50xx: Handle reg to get correct multi_index 2025-08-28 16:26:00 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:49:22 +02:00
mailbox mailbox: Not protect module_put with spin_lock_irqsave 2025-07-06 10:57:54 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:46:57 +02:00
md minmax: add a few more MIN_T/MAX_T users 2025-10-02 13:40:43 +02:00
media minmax: make generic MIN() and MAX() macros available everywhere 2025-10-02 13:40:43 +02:00
memory memory: omap-gpmc: drop no compatible check 2025-04-10 14:33:39 +02:00
memstick memstick: Fix deadlock by moving removing flag earlier 2025-08-28 16:26:13 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-14 19:53:40 +01:00
mfd mfd: max14577: Fix wakeup source leaks on device unbind 2025-07-06 10:57:54 +02:00
misc misc: rtsx: usb: Ensure mmc child device is active when card is present 2025-08-28 16:26:03 +02:00
mmc mmc: mvsdio: Fix dma_unmap_sg() nents value 2025-09-25 10:58:53 +02:00
most most: core: Drop device reference after usage in get_channel() 2025-08-28 16:26:14 +02:00
mtd mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing 2025-09-19 16:29:57 +02:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net minmax: add a few more MIN_T/MAX_T users 2025-10-02 13:40:43 +02:00
nfc minmax: make generic MIN() and MAX() macros available everywhere 2025-10-02 13:40:43 +02:00
ntb ntb_hw_amd: Add NTB PCI ID for new gen CPU 2025-05-02 07:47:04 +02:00
nubus nubus: Partially revert proc_create_single_data() conversion 2023-07-05 18:27:37 +01:00
nvdimm libnvdimm/labels: Fix divide error in nd_label_data_init() 2025-06-04 14:40:04 +02:00
nvme nvme: fix misaccounting of nvme-mpath inflight I/O 2025-07-24 08:51:52 +02:00
nvmem nvmem: layouts: u-boot-env: remove crc32 endianness conversion 2025-07-24 08:51:55 +02:00
of of: module: add buffer overflow check in of_modalias() 2025-05-02 07:47:08 +02:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-21 13:49:02 +01:00
parisc parisc/power: Fix power soft-off button emulation on qemu 2024-01-31 16:16:59 -08:00
parport parport_pc: add support for ASIX AX99100 2025-02-21 13:50:11 +01:00
pci PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads 2025-09-09 18:54:18 +02:00
pcmcia pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch 2025-09-25 10:58:50 +02:00
peci peci: cpu: Fix use-after-free in adev_release() 2022-08-15 20:31:35 +02:00
perf perf/arm-cmn: Initialise cmn->cpu earlier 2025-06-04 14:40:25 +02:00
phy phy: ti: omap-usb2: fix device leak at unbind 2025-09-25 10:58:54 +02:00
pinctrl pinctrl: STMFX: add missing HAS_IOMEM dependency 2025-09-04 15:26:24 +02:00
platform minmax: make generic MIN() and MAX() macros available everywhere 2025-10-02 13:40:43 +02:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:12:47 +00:00
power power: supply: bq27xxx: restrict no-battery detection to bq27000 2025-09-25 10:58:52 +02:00
powercap powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() 2025-08-15 12:04:54 +02:00
pps pps: clients: gpio: fix interrupt handling order in remove path 2025-08-28 16:25:53 +02:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: Use ratelimite for freerun error message 2025-08-28 16:25:58 +02:00
pwm pwm: mediatek: Fix duty and period setting 2025-08-28 16:26:07 +02:00
rapidio drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-27 11:07:36 +01:00
ras RAS/CEC: Reduce offline page threshold for Intel systems 2022-08-22 19:30:02 +02:00
regulator regulator: sy7636a: fix lifecycle of power good gpio 2025-09-19 16:29:59 +02:00
remoteproc remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU 2025-08-28 16:25:52 +02:00
reset reset: brcmstb: Enable reset drivers for ARCH_BCM2835 2025-08-28 16:25:53 +02:00
rpmsg rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() 2025-06-27 11:07:15 +01:00
rtc rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe 2025-08-28 16:26:03 +02:00
s390 s390/sclp: Fix SCCB present check 2025-08-28 16:26:13 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi minmax: make generic MIN() and MAX() macros available everywhere 2025-10-02 13:40:43 +02:00
sh sh: clk: Fix clk_enable() to return 0 on NULL clk 2024-12-27 13:52:58 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 12:53:22 +01:00
soc soc: qcom: mdt_loader: Deal with zero e_shentsize 2025-09-19 16:30:00 +02:00
soundwire soundwire: stream: restore params when prepare ports fail 2025-08-15 12:05:04 +02:00
spi spi: tegra114: Use value to check for invalid delays 2025-09-09 18:54:24 +02:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:35:55 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:30:27 +02:00
staging minmax: make generic MIN() and MAX() macros available everywhere 2025-10-02 13:40:43 +02:00
target scsi: target: core: Generate correct identifiers for PR OUT transport IDs 2025-08-28 16:26:02 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" 2025-09-09 18:54:13 +02:00
thermal thermal: sysfs: Return ENODATA instead of EAGAIN for reads 2025-08-28 16:25:53 +02:00
thunderbolt thunderbolt: Fix copy+paste error in match_service_id() 2025-08-28 16:26:04 +02:00
tty serial: sc16is7xx: fix bug in flow control levels init 2025-09-19 16:29:58 +02:00
ufs scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE 2025-08-28 16:26:15 +02:00
uio uio_hv_generic: Align ring size to system page 2025-07-06 10:57:58 +02:00
usb usb: core: Add 0x prefix to quirks debug output 2025-10-02 13:40:36 +02:00
vdpa vdpa/mlx5: Fix oversized null mkey longer than 32bit 2025-04-25 10:43:40 +02:00
vfio vfio/mlx5: fix possible overflow in tracking max message size 2025-08-28 16:26:02 +02:00
vhost vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() 2025-09-04 15:26:26 +02:00
video fbcon: Fix OOB access in font allocation 2025-10-02 13:40:41 +02:00
virt minmax: add in_range() macro 2025-10-02 13:40:41 +02:00
virtio virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN 2025-06-04 14:40:01 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 w1: fix loop in w1_fini() 2023-07-19 16:21:48 +02:00
watchdog watchdog: iTCO_wdt: Report error if timeout configuration fails 2025-08-28 16:25:59 +02:00
xen xen/gntdev: remove struct gntdev_copy_batch from stack 2025-08-15 12:04:58 +02:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig vme: move back to staging 2022-06-10 15:38:14 +02:00
Makefile hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device 2022-09-08 16:26:17 -06:00