kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/video/fbdev
History
Vlad Tsyrklevich cce7cb8397 omap2fb: Fix stack memory disclosure 
commit a01421e448 upstream.

Using [1] for static analysis I found that the OMAPFB_QUERY_PLANE,
OMAPFB_GET_COLOR_KEY, OMAPFB_GET_DISPLAY_INFO, and OMAPFB_GET_VRAM_INFO
cases could all leak uninitialized stack memory--either due to
uninitialized padding or 'reserved' fields.

Fix them by clearing the shared union used to store copied out data.

[1] https://github.com/vlad902/kernel-uninitialized-memory-checker

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Reviewed-by: Kees Cook <keescook@chromium.org>
Fixes: b39a982dde ("OMAP: DSS2: omapfb driver")
Cc: security@kernel.org
[b.zolnierkie: prefix patch subject with "omap2fb: "]
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-05-02 21:41:19 +01:00
..
aty mach64: fix image corruption due to reading accelerator registers 2019-02-11 17:53:28 +00:00
core fbdev: fbmem: behave better with small rotated displays and many CPUs 2019-04-04 16:14:02 +01:00
exynos video: exynos: Add a dependency to the menu 2014-05-09 12:55:48 +03:00
geode video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
i810 video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
intelfb video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
kyro video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
matrox matroxfb: perform a dummy read of M_STATUS 2014-05-23 13:44:25 +03:00
mb862xx video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
mbx video/mbx: fix building debugfs support 2014-05-09 12:55:46 +03:00
mmp video: mmpfb: cleanup some static checker warnings in probe() 2014-04-30 13:57:29 +03:00
msm video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
nvidia video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
omap fbdev: omapfb: off by one in omapfb_register_client() 2018-12-16 22:08:19 +00:00
omap2 omap2fb: Fix stack memory disclosure 2019-05-02 21:41:19 +01:00
riva video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
savage video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sis video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
vermilion video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
via video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
68328fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
acornfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
acornfb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
amba-clcd.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
amifb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
arcfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
arkfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
asiliantfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
atafb.c m68k/atari - atafb: convert allocation of fb ram to new interface 2014-05-26 22:41:24 +02:00
atafb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
atafb_iplan2p2.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
atafb_iplan2p4.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
atafb_iplan2p8.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
atafb_mfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
atafb_utils.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
atmel_lcdfb.c video: fbdev: atmel_lcdfb: fix display-timings lookup 2018-06-16 22:21:45 +01:00
au1100fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
au1100fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
au1200fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
au1200fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
auo_k190x.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
auo_k190x.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
auo_k1900fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
auo_k1901fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
bf54x-lq043fb.c video: delete unneeded call to platform_get_drvdata 2014-05-19 16:03:57 +03:00
bf537-lq035.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
bfin-lq035q1-fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
bfin-t350mcqb-fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
bfin_adv7393fb.c fb: adv7393: add missing semicolon 2014-07-01 13:18:38 +03:00
bfin_adv7393fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
broadsheetfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
bt431.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
bt455.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
bw2.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
c2p.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
c2p_core.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
c2p_iplan2.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
c2p_planar.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
carminefb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
carminefb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
carminefb_regs.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
cg3.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
cg6.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
cg14.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
chipsfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
cirrusfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
clps711xfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
cobalt_lcdfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
controlfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
controlfb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
cyber2000fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
cyber2000fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
da8xx-fb.c fbdev: da8xx-fb: fix videomodes of lcd panels 2016-05-01 00:05:51 +02:00
dnfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
edid.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
efifb.c fbdev/efifb: Fix 16 color palette entry calculation 2017-02-23 03:53:53 +00:00
ep93xx-fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
fb-puv3.c drivers/video/fbdev/fb-puv3.c: Add header files for function unifb_mmap 2014-05-23 13:51:10 +03:00
ffb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
fm2fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
fsl-diu-fb.c video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented 2016-01-25 10:43:33 +00:00
g364fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
gbefb.c video: fbdev: Fix format string mismatch in gbefb.c 2014-04-30 11:24:40 +03:00
goldfishfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
grvga.c video: fbdev: grvga.c: Fix for possible null pointer dereference 2014-05-23 13:47:31 +03:00
gxt4500.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
hecubafb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
hgafb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
hitfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
hpfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
hyperv_fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
i740_reg.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
i740fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
igafb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
imsttfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
imxfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
jz4740_fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
Kconfig video: mx3fb: always enable BACKLIGHT_LCD_SUPPORT 2017-11-11 13:33:55 +00:00
leo.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
macfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
macmodes.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
macmodes.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
Makefile fbdev: move fbdev core files to separate directory 2014-04-17 08:10:19 +03:00
maxinefb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
metronomefb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
mx3fb.c video: mx3fb: Add backlight control support 2014-05-16 11:58:39 +03:00
mxsfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
n411.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
neofb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
nuc900fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
nuc900fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
ocfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
offb.c Revert "offb: Add palette hack for little endian" 2014-06-16 19:45:45 +10:00
p9100.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
platinumfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
platinumfb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pm2fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pm3fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pmag-aa-fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pmag-ba-fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pmagb-b-fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
ps3fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pvr2fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pxa3xx-gcu.c video: pxa3xx-gcu: use devm_ioremap_resource() 2014-04-30 14:02:15 +03:00
pxa3xx-gcu.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pxa168fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pxa168fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pxafb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
pxafb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
q40fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
s1d13xxxfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
s3c-fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
s3c2410fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
s3c2410fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
s3fb.c video: fbdev: s3fb.c: Fix for possible null pointer dereference 2014-05-23 13:47:31 +03:00
sa1100fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sa1100fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sbuslib.c fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper(). 2018-06-16 22:21:32 +01:00
sbuslib.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sh7760fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sh_mipi_dsi.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sh_mobile_hdmi.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sh_mobile_lcdcfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sh_mobile_lcdcfb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sh_mobile_meram.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
simplefb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
skeletonfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sm501fb.c drivers/video/fbdev/sm501fb.c: avoid world-writable sysfs files. 2014-05-14 10:53:54 +09:30
smscufx.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
ssd1307fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sstfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sticore.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
stifb.c video/fbdev/stifb: Return -ENOMEM after a failed kzalloc() in stifb_init_fb() 2018-10-21 08:45:04 +01:00
sunxvr500.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sunxvr1000.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
sunxvr2500.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
tcx.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
tdfxfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
tgafb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
tmiofb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
tridentfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
udlfb.c udlfb: set line_length in dlfb_ops_set_par 2018-12-16 22:08:23 +00:00
uvesafb.c video: uvesafb: Fix integer overflow in allocation 2018-09-25 23:47:32 +01:00
valkyriefb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
valkyriefb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
vesafb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
vfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
vga16fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
vt8500lcdfb.c video: vt8500lcdfb: Remove kfree call since devm_kzalloc() is used 2014-06-26 14:40:07 +03:00
vt8500lcdfb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
vt8623fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
w100fb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
w100fb.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
wm8505fb.c video: fbdev: Fix format string mismatch in wm8505fb.c 2014-04-30 11:24:40 +03:00
wm8505fb_regs.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
wmt_ge_rops.c fbdev: move fbdev core files to separate directory 2014-04-17 08:10:19 +03:00
wmt_ge_rops.h video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00
xen-fbfront.c xen, fbfront: fix connecting to backend 2017-07-18 18:40:33 +01:00
xilinxfb.c video: move fbdev to drivers/video/fbdev 2014-04-17 08:10:19 +03:00