openstlinux/linux-st
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
7ea4007757e56bd2fb589820ba7676d2dfb0b47a
linux-st/drivers/video/fbdev
History
Kees Cook 2dc705a993 fbdev: color map copying bounds checking 
Copying color maps to userspace doesn't check the value of to->start,
which will cause kernel heap buffer OOB read due to signedness wraps.

CVE-2016-8405

Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Peter Pi (@heisecode) of Trend Micro
Cc: Min Chong <mchong@google.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-01-24 16:26:14 -08:00
..
aty
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
core
fbdev: color map copying bounds checking
2017-01-24 16:26:14 -08:00
geode
…
i810
video: fbdev: i810: add in missing white space in error message text
2016-09-27 11:08:15 +03:00
intelfb
video: fbdev: intelfb: remove impossible condition
2016-09-07 11:16:05 +03:00
kyro
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
matrox
matroxfb: fix size of memcpy
2016-09-27 11:43:24 +03:00
mb862xx
video: fbdev: mb862xx: remove unused variable
2016-08-30 12:00:15 +03:00
mbx
…
mmp
…
nvidia
…
omap
fbdev: Remove deprecated create_singlethread_workqueue
2016-08-11 17:54:56 +03:00
omap2
omapfb: fix return value check in dsi_bind()
2016-09-27 11:04:05 +03:00
riva
…
savage
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
sis
…
vermilion
…
via
…
68328fb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
acornfb.c
…
acornfb.h
…
amba-clcd-nomadik.c
video: ARM CLCD: export symbols for driver module
2016-08-30 11:54:23 +03:00
amba-clcd-nomadik.h
video: ARM CLCD: add special board and panel hooks for Nomadik
2016-08-11 17:54:54 +03:00
amba-clcd-versatile.c
video: ARM CLCD: fix Vexpress regression
2016-11-03 12:20:14 +02:00
amba-clcd-versatile.h
video: ARM CLCD: add special panel hook for Versatiles
2016-08-11 17:54:54 +03:00
amba-clcd.c
video: ARM CLCD: fix endpoint lookup logic
2016-08-30 11:31:22 +03:00
amifb.c
…
arcfb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
arkfb.c
…
asiliantfb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
atafb_iplan2p2.c
…
atafb_iplan2p4.c
…
atafb_iplan2p8.c
…
atafb_mfb.c
…
atafb_utils.h
…
atafb.c
…
atafb.h
…
atmel_lcdfb.c
…
au1100fb.c
…
au1100fb.h
…
au1200fb.c
mips: separate extable.h, switch module.h to it
2016-10-05 18:36:18 -04:00
au1200fb.h
…
auo_k190x.c
…
auo_k190x.h
…
auo_k1900fb.c
…
auo_k1901fb.c
…
bf54x-lq043fb.c
…
bf537-lq035.c
…
bfin_adv7393fb.c
fb: adv7393: off by one in probe function
2016-08-30 12:06:12 +03:00
bfin_adv7393fb.h
fbdev/bfin_adv7393fb: move DRIVER_NAME before its first use
2016-08-02 19:35:05 -04:00
bfin-lq035q1-fb.c
…
bfin-t350mcqb-fb.c
…
broadsheetfb.c
…
bt431.h
…
bt455.h
…
bw2.c
…
c2p_core.h
…
c2p_iplan2.c
…
c2p_planar.c
…
c2p.h
…
carminefb_regs.h
…
carminefb.c
…
carminefb.h
…
cg3.c
…
cg6.c
…
cg14.c
…
chipsfb.c
…
cirrusfb.c
…
clps711x-fb.c
video: clps711x-fb: Changing the compatibility string to match with the smallest supported chip
2016-07-06 17:38:19 +02:00
clps711xfb.c
…
cobalt_lcdfb.c
video: fbdev: cobalt_lcdfb: Handle return NULL error from devm_ioremap
2017-01-04 12:58:45 +01:00
controlfb.c
…
controlfb.h
…
cyber2000fb.c
…
cyber2000fb.h
…
da8xx-fb.c
remove lots of IS_ERR_VALUE abuses
2016-05-27 15:26:11 -07:00
dnfb.c
…
edid.h
…
efifb.c
efifb: Show framebuffer layout as device attributes
2016-10-18 17:11:19 +02:00
ep93xx-fb.c
…
fb-puv3.c
…
ffb.c
…
fm2fb.c
…
fsl-diu-fb.c
…
g364fb.c
…
gbefb.c
…
goldfishfb.c
…
grvga.c
…
gxt4500.c
…
hecubafb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
hgafb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
hitfb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
hpfb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
hyperv_fb.c
…
i740_reg.h
…
i740fb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
igafb.c
…
imsttfb.c
…
imxfb.c
…
jz4740_fb.c
…
Kconfig
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus
2016-10-15 09:26:12 -07:00
leo.c
…
macfb.c
…
macmodes.c
…
macmodes.h
…
Makefile
video: fbdev: exynos: Remove old non-working MIPI driver
2016-09-27 11:05:29 +03:00
maxinefb.c
…
metronomefb.c
…
mx3fb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
mxsfb.c
video: mxsfb: Fix framebuffer corruption on mx6sx
2016-08-30 11:59:33 +03:00
n411.c
…
neofb.c
…
nuc900fb.c
…
nuc900fb.h
…
ocfb.c
…
offb.c
video: fbdev: offb: Call pci_enable_device() before using the PCI VGA device
2016-09-27 10:55:02 +03:00
p9100.c
…
platinumfb.c
…
platinumfb.h
…
pm2fb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
pm3fb.c
…
pmag-aa-fb.c
…
pmag-ba-fb.c
…
pmagb-b-fb.c
…
ps3fb.c
…
pvr2fb.c
mm: replace get_user_pages_unlocked() write/force parameters with gup_flags
2016-10-18 14:13:37 -07:00
pxa3xx-gcu.c
…
pxa3xx-gcu.h
…
pxa168fb.c
…
pxa168fb.h
…
pxafb.c
video: fbdev: pxafb: add missing of_node_put() in of_get_pxafb_mode_info()
2016-08-30 12:04:16 +03:00
pxafb.h
…
q40fb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
s1d13xxxfb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
s3c2410fb.c
video: s3c2410fb: Register cpufreq notifier only on S3C24xx
2016-08-11 17:54:55 +03:00
s3c2410fb.h
video: s3c2410fb: Register cpufreq notifier only on S3C24xx
2016-08-11 17:54:55 +03:00
s3c-fb.c
…
s3fb.c
…
sa1100fb.c
…
sa1100fb.h
…
sbuslib.c
…
sbuslib.h
…
sh7760fb.c
…
sh_mobile_lcdcfb.c
…
sh_mobile_lcdcfb.h
…
sh_mobile_meram.c
…
simplefb.c
simplefb: Disable and release clocks and regulators in destroy callback
2016-09-27 11:21:36 +03:00
skeletonfb.c
docs: fix locations of several documents that got moved
2016-10-24 08:12:35 -02:00
sm501fb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
sm712.h
…
sm712fb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
smscufx.c
video: smscufx: remove unused variable
2016-09-27 11:47:37 +03:00
ssd1307fb.c
fbdev: ssd1307fb: fix a possible NULL dereference
2016-09-27 11:41:30 +03:00
sstfb.c
…
sticore.h
…
stifb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
sunxvr500.c
…
sunxvr1000.c
…
sunxvr2500.c
…
tcx.c
…
tdfxfb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
tgafb.c
…
tmiofb.c
…
tridentfb.c
…
udlfb.c
…
uvesafb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
valkyriefb.c
…
valkyriefb.h
…
vesafb.c
…
vfb.c
fbdev: vfb: simplify memory management
2016-09-07 12:06:53 +03:00
vga16fb.c
video: fbdev: constify fb_fix_screeninfo and fb_var_screeninfo structures
2016-09-27 11:16:35 +03:00
vt8500lcdfb.c
…
vt8500lcdfb.h
…
vt8623fb.c
…
w100fb.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
w100fb.h
…
wm8505fb_regs.h
…
wm8505fb.c
…
wmt_ge_rops.c
…
wmt_ge_rops.h
…
xen-fbfront.c
xen: make use of xenbus_read_unsigned() in xen-fbfront
2016-11-07 13:55:32 +01:00
xilinxfb.c
…