iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
v4.9.241
linux/drivers/gpu/drm
History
Doug Horn 466de4edf4 Fix use after free in get_capset_info callback. 
[ Upstream commit e219688fc5c3d0d9136f8d29d7e0498388f01440 ]

If a response to virtio_gpu_cmd_get_capset_info takes longer than
five seconds to return, the callback will access freed kernel memory
in vg->capsets.

Signed-off-by: Doug Horn <doughorn@google.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-2-gurchetansingh@chromium.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29 09:05:45 +01:00
..
amd
drm/amdgpu: prevent double kfree ttm->sg
2020-10-14 09:48:16 +02:00
arc
drm/arcpgu: Accommodate adv7511 switch to DRM bridge
2016-11-11 04:31:35 +03:00
arm
drm/arm/hdlcd: Allow a bit of clock tolerance
2019-07-10 09:55:30 +02:00
armada
drm/armada: fix colorkey mode property
2018-08-24 13:12:37 +02:00
ast
drm/ast: Fix connector leak during driver unload
2018-12-21 14:11:39 +01:00
atmel-hlcdc
drm: atmel-hlcdc: enable clock before configuring timing engine
2020-02-14 16:31:07 -05:00
bochs
drm/bochs: downgrade pci_request_region failure from error to warning
2020-04-13 10:32:51 +02:00
bridge
drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
2020-01-04 13:39:01 +01:00
cirrus
drm/drivers: add support for using the arch wc mapping API.
2016-10-26 16:48:01 +10:00
etnaviv
drm/etnaviv: replace MMU flush marker with flush sequence
2020-04-13 10:32:52 +02:00
exynos
drm/exynos: dsi: fix workaround for the legacy clock name
2020-04-02 17:20:22 +02:00
fsl-dcu
drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume()
2017-12-09 22:01:46 +01:00
gma500
drm/gma500: fix error check
2020-10-29 09:05:34 +01:00
hisilicon
drm/hisilicon: Ensure LDI regs are properly configured.
2017-12-05 11:24:35 +01:00
i2c
Revert "drm/i2c: tda998x: don't register the connector"
2016-09-23 03:29:50 -07:00
i810
drm/i810: Prevent underflow in ioctl
2019-12-21 10:41:37 +01:00
i915
drm/i915: Whitelist context-local timestamp in the gen9 cmdparser
2020-06-30 15:38:32 -04:00
imx
drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
2020-08-26 10:29:02 +02:00
mediatek
drm/mediatek: Add exception handing in mtk_drm_probe() if component init fail
2020-09-23 08:46:16 +02:00
mga
drm/mga: remove device_is_agp callback
2017-04-12 12:41:20 +02:00
mgag200
gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap
2017-11-21 09:23:26 +01:00
msm
drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation
2020-06-30 15:38:25 -04:00
nouveau
drm/nouveau: Fix reference count leak in nouveau_connector_detect
2020-09-03 11:21:17 +02:00
omapdrm
drm/omap: fix possible object reference leak
2020-10-01 20:40:07 +02:00
panel
drm: panel: simple: Fix bpc for LG LB070WV8 panel
2020-08-21 11:02:01 +02:00
qxl
drm/qxl: Use correct notify port address when creating cursor ring
2020-06-30 15:38:31 -04:00
r128
…
radeon
drm/radeon: fix multiple reference count leak
2020-09-03 11:21:16 +02:00
rcar-du
drm: rcar-du: Handle event when disabling CRTCs
2018-03-22 09:17:47 +01:00
rockchip
drm/rockchip: Properly adjust to a true clock in adjusted_mode
2019-08-04 09:33:38 +02:00
savage
drm/savage: dereferencing an error pointer
2017-01-19 20:17:58 +01:00
shmobile
…
sis
…
sti
drm/sti: do not remove the drm_bridge that was never added
2020-01-29 10:24:00 +01:00
sun4i
drm/sun4i: Set device driver data at bind time for use in unbind
2019-05-16 19:43:43 +02:00
tdfx
…
tegra
drm/tegra: dpaux: Fix error handling
2017-01-19 20:17:58 +01:00
tilcdc
drm/tilcdc: fix leak & null ref in panel_connector_get_modes
2020-08-21 11:01:57 +02:00
ttm
drm/ttm: never add BO that failed to validate to the LRU list
2018-03-22 09:17:45 +01:00
udl
udl-kms: fix crash due to uninitialized memory
2018-09-05 09:20:09 +02:00
vc4
drm/vc4: Fix compilation error reported by kbuild test bot
2019-05-02 09:32:02 +02:00
vgem
drm: Don't swallow error codes in drm_dev_alloc()
2016-09-22 04:03:48 -07:00
via
mm: replace get_user_pages() write/force parameters with gup_flags
2016-10-19 08:11:43 -07:00
virtio
Fix use after free in get_capset_info callback.
2020-10-29 09:05:45 +01:00
vmwgfx
drm/vmwgfx: Fix two list_for_each loop exit tests
2020-08-21 11:02:10 +02:00
ati_pcigart.c
…
drm_agpsupport.c
…
drm_atomic_helper.c
drm: reference count event->completion
2017-03-30 09:41:28 +02:00
drm_atomic.c
drm/atomic: Handling the case when setting old crtc for plane
2018-08-03 07:55:23 +02:00
drm_auth.c
drm: set is_master to 0 upon drm_new_set_master() failure
2018-12-08 13:05:06 +01:00
drm_blend.c
drm/doc: Polish plane composition property docs
2016-09-22 00:04:02 -07:00
drm_bridge.c
drm: Extract drm_bridge.h
2016-09-19 15:04:15 +02:00
drm_bufs.c
drm/bufs: Fix Spectre v1 vulnerability
2019-02-12 19:44:50 +01:00
drm_cache.c
…
drm_color_mgmt.c
drm/doc: Document color space handling
2016-09-22 00:04:03 -07:00
drm_connector.c
drm: Don't race connector registration
2017-06-17 06:41:53 +02:00
drm_context.c
…
drm_crtc_helper_internal.h
drm/fb-helper: Fix sparse warnings
2016-09-19 16:45:15 +02:00
drm_crtc_helper.c
…
drm_crtc_internal.h
drm: Extract drm_color_mgmt.[hc]
2016-09-22 00:04:02 -07:00
drm_crtc.c
drm: Extract drm_color_mgmt.[hc]
2016-09-22 00:04:02 -07:00
drm_debugfs.c
drm/debugfs: fix plain echo to connector "force" attribute
2020-08-21 11:01:58 +02:00
drm_dma.c
…
drm_dp_aux_dev.c
…
drm_dp_dual_mode_helper.c
drm/i915: Fix LSPCON TMDS output buffer enabling from low-power state
2018-04-29 11:31:56 +02:00
drm_dp_helper.c
drm/psr: Fix missed entry in PSR setup time table.
2018-06-06 16:44:38 +02:00
drm_dp_mst_topology.c
drm/dp_mst: Increase ACT retry timeout to 3s
2020-06-30 15:38:31 -04:00
drm_drv.c
drm: drm_minor_register(): Clean up debugfs on failure
2017-11-15 15:53:12 +01:00
drm_edid_load.c
…
drm_edid.c
drm/edid: Fix off-by-one in DispID DTD pixel clock
2020-05-05 19:14:29 +02:00
drm_encoder_slave.c
drm: encoder_slave: fix refcouting error for modules
2020-06-30 15:38:31 -04:00
drm_encoder.c
drm: Fix typo in encoder docs
2016-09-21 13:33:50 +02:00
drm_fb_cma_helper.c
…
drm_fb_helper.c
drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock
2019-01-23 08:10:57 +01:00
drm_flip_work.c
…
drm_fops.c
drm: Wake up next in drm_read() chain if we are forced to putback the event
2019-05-31 06:48:31 -07:00
drm_fourcc.c
…
drm_framebuffer.c
drm: Extract drm_plane.[hc]
2016-09-22 00:01:56 -07:00
drm_gem_cma_helper.c
…
drm_gem.c
drm: hold gem reference until object is no longer accessed
2020-08-21 11:01:48 +02:00
drm_global.c
drm: modify drm_global_item_ref to avoid two times of writing ref->object
2016-09-14 15:10:29 -04:00
drm_hashtab.c
…
drm_info.c
drm: Print device information again in debugfs
2016-10-17 16:20:53 +10:00
drm_internal.h
drm: drop obsolete drm_core.h
2016-09-19 13:57:38 +02:00
drm_ioc32.c
drm: drop obsolete drm_core.h
2016-09-19 13:57:38 +02:00
drm_ioctl.c
drm/ioctl: Fix Spectre v1 vulnerabilities
2018-12-29 13:40:16 +01:00
drm_irq.c
drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off)
2018-03-22 09:17:39 +01:00
drm_kms_helper_common.c
…
drm_legacy.h
…
drm_lock.c
…
drm_memory.c
…
drm_mipi_dsi.c
drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
2020-08-21 11:02:00 +02:00
drm_mm.c
drm: Apply range restriction after color adjustment when allocation
2017-11-30 08:39:13 +00:00
drm_mode_object.c
drm: Move property validation to a helper, v2.
2016-09-12 10:32:49 -04:00
drm_modes.c
drm/modes: Prevent division by zero htotal
2019-02-15 08:07:38 +01:00
drm_modeset_helper.c
…
drm_modeset_lock.c
drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
2018-02-25 11:05:41 +01:00
drm_of.c
…
drm_panel.c
…
drm_pci.c
drm: Remove PageReserved manipulation from drm_pci_alloc
2020-04-24 07:59:00 +02:00
drm_plane_helper.c
…
drm_plane.c
drm: Undo damage to page_flip_ioctl
2016-10-04 12:53:12 +10:00
drm_platform.c
drm: Don't swallow error codes in drm_dev_alloc()
2016-09-22 04:03:48 -07:00
drm_prime.c
drm: Fix up kerneldoc for new drm_gem_dmabuf_export()
2016-10-10 11:19:42 +02:00
drm_probe_helper.c
drm: Flush output polling on shutdown
2019-10-05 12:30:11 +02:00
drm_property.c
drm: limit to INT_MAX in create_blob ioctl
2020-01-12 11:24:12 +01:00
drm_rect.c
…
drm_scatter.c
…
drm_simple_kms_helper.c
drm: simple_kms_helper: Add prepare_fb and cleanup_fb hooks
2016-10-05 15:18:02 +02:00
drm_sysfs.c
drm: drop obsolete drm_core.h
2016-09-19 13:57:38 +02:00
drm_trace_points.c
…
drm_trace.h
…
drm_vm.c
…
drm_vma_manager.c
drm: use drm_file to tag vm-bos
2016-09-19 11:22:08 +02:00
Kconfig
…
Makefile
drm: Extract drm_color_mgmt.[hc]
2016-09-22 00:04:02 -07:00