iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/video/fbdev
History
Tetsuo Handa d9b53caf01 fbcon: Use kzalloc() in fbcon_prepare_logo() 
[ Upstream commit a6a00d7e8ffd78d1cdb7a43f1278f081038c638f ]

A kernel built with syzbot's config file reported that

  scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2))

causes uninitialized "save" to be copied.

  ----------
  [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
  [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
  Console: switching to colour frame buffer device 128x48
  =====================================================
  BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0
   do_update_region+0x4b8/0xba0
   update_region+0x40d/0x840
   fbcon_switch+0x3364/0x35e0
   redraw_screen+0xae3/0x18a0
   do_bind_con_driver+0x1cb3/0x1df0
   do_take_over_console+0x11cb/0x13f0
   fbcon_fb_registered+0xacc/0xfd0
   register_framebuffer+0x1179/0x1320
   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
   drm_fbdev_client_hotplug+0xbea/0xda0
   drm_fbdev_generic_setup+0x65e/0x9d0
   vkms_init+0x9f3/0xc76
   (...snipped...)

  Uninit was stored to memory at:
   fbcon_prepare_logo+0x143b/0x1940
   fbcon_init+0x2c1b/0x31c0
   visual_init+0x3e7/0x820
   do_bind_con_driver+0x14a4/0x1df0
   do_take_over_console+0x11cb/0x13f0
   fbcon_fb_registered+0xacc/0xfd0
   register_framebuffer+0x1179/0x1320
   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
   drm_fbdev_client_hotplug+0xbea/0xda0
   drm_fbdev_generic_setup+0x65e/0x9d0
   vkms_init+0x9f3/0xc76
   (...snipped...)

  Uninit was created at:
   __kmem_cache_alloc_node+0xb69/0x1020
   __kmalloc+0x379/0x680
   fbcon_prepare_logo+0x704/0x1940
   fbcon_init+0x2c1b/0x31c0
   visual_init+0x3e7/0x820
   do_bind_con_driver+0x14a4/0x1df0
   do_take_over_console+0x11cb/0x13f0
   fbcon_fb_registered+0xacc/0xfd0
   register_framebuffer+0x1179/0x1320
   __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
   drm_fbdev_client_hotplug+0xbea/0xda0
   drm_fbdev_generic_setup+0x65e/0x9d0
   vkms_init+0x9f3/0xc76
   (...snipped...)

  CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924
  Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
  ----------

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/cad03d25-0ea0-32c4-8173-fd1895314bce@I-love.SAKURA.ne.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-14 11:31:54 +01:00
..
aty
fbdev: aty: remove CONFIG_PM container
2020-09-18 14:45:44 +02:00
core
fbcon: Use kzalloc() in fbcon_prepare_logo()
2022-12-14 11:31:54 +01:00
geode
fbdev: lxfb: use generic power management
2020-09-08 13:33:10 +02:00
i810
video: fbdev: i810: use true,false for bool variables
2020-05-06 19:29:10 +02:00
intelfb
drm pull for 5.6-rc1
2020-01-30 08:04:01 -08:00
kyro
video: fbdev: kyro: Error out if 'pixclock' equals zero
2021-09-18 13:40:22 +02:00
matrox
video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen
2022-04-08 14:40:05 +02:00
mb862xx
video: fbdev: mb862xx: remove set but not used variable 'mdr'
2020-04-08 12:09:15 +02:00
mmp
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
nvidia
video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
2022-04-08 14:40:33 +02:00
omap
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
omap2
video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
2022-04-08 14:40:35 +02:00
riva
video: fbdev: riva: Error out if 'pixclock' equals zero
2021-09-18 13:40:22 +02:00
savage
fbdev: savagefb: use generic power management
2020-09-08 13:33:15 +02:00
sis
video: fbdev: sis: fix typos in SiS_GetModeID()
2022-08-21 15:16:10 +02:00
vermilion
remove ioremap_nocache and devm_ioremap_nocache
2020-01-06 09:45:59 +01:00
via
Merge drm/drm-next into drm-misc-next
2020-09-14 18:11:40 +02:00
68328fb.c
video/fbdev/68328fb: Remove dead code
2020-01-03 14:27:43 +01:00
acornfb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
acornfb.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
amba-clcd.c
video: fbdev: amba-clcd: Fix refcount leak bugs
2022-08-21 15:16:10 +02:00
amifb.c
video: fbdev: amifb: add FIXMEs about {put,get}_user() failures
2020-07-10 16:17:20 +02:00
arcfb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
arkfb.c
video: fbdev: arkfb: Check the size of screen before memset_io()
2022-08-21 15:16:13 +02:00
asiliantfb.c
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
2021-09-18 13:40:22 +02:00
atafb_iplan2p2.c
…
atafb_iplan2p4.c
…
atafb_iplan2p8.c
…
atafb_mfb.c
…
atafb_utils.h
…
atafb.c
video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
2022-04-08 14:39:56 +02:00
atafb.h
…
atmel_lcdfb.c
video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe()
2022-04-08 14:40:06 +02:00
au1100fb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
au1100fb.h
au1100fb: fix DMA API abuse
2019-06-03 16:00:08 +02:00
au1200fb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
au1200fb.h
…
broadsheetfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
bt431.h
…
bt455.h
…
bw2.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
c2p_core.h
fbdev: c2p: Use BUILD_BUG() instead of custom solution
2020-03-09 11:12:19 +01:00
c2p_iplan2.c
…
c2p_planar.c
…
c2p.h
…
carminefb_regs.h
…
carminefb.c
drm pull for 5.6-rc1
2020-01-30 08:04:01 -08:00
carminefb.h
…
cg3.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
cg6.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
cg14.c
fbdev: cg14fb: use resource_size
2020-01-15 17:31:50 +01:00
chipsfb.c
fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
2022-09-15 11:32:03 +02:00
cirrusfb.c
video: fbdev: cirrusfb: check pixclock to avoid divide by zero
2022-04-08 14:40:34 +02:00
clps711x-fb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
cobalt_lcdfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
controlfb.c
video: fbdev: controlfb: Fix COMPILE_TEST build
2022-04-08 14:40:06 +02:00
controlfb.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
cyber2000fb.c
fbdev: cyber2000fb: use generic power management
2020-09-08 13:33:16 +02:00
cyber2000fb.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
da8xx-fb.c
fbdev: da8xx-fb: go to proper label on error handling paths in probe
2020-07-10 16:17:28 +02:00
dnfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
edid.h
…
efifb.c
efi: avoid error message when booting under Xen
2020-08-20 06:26:22 +02:00
ep93xx-fb.c
video: fbdev: Replace HTTP links with HTTPS ones
2020-07-20 11:47:29 +02:00
ffb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
fm2fb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
fsl-diu-fb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
g364fb.c
fbdev/g364fb: Fix build failure
2020-02-19 10:58:22 -08:00
gbefb.c
video: fbdev: gbefb: Only instantiate device when built for IP32
2021-10-13 10:04:28 +02:00
goldfishfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
grvga.c
video: fbdev: Replace HTTP links with HTTPS ones
2020-07-20 11:47:29 +02:00
gxt4500.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
hecubafb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
hgafb.c
video: hgafb: correctly handle card detect failure during probe
2021-05-26 12:06:57 +02:00
hitfb.c
mm: don't include asm/pgtable.h if linux/mm.h is already included
2020-06-09 09:39:13 -07:00
hpfb.c
maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2020-06-17 10:57:41 -07:00
hyperv_fb.c
video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1
2022-06-14 18:32:38 +02:00
i740_reg.h
…
i740fb.c
video: fbdev: i740fb: Error out if 'pixclock' equals zero
2022-09-23 14:16:58 +02:00
imsttfb.c
Revert "video: imsttfb: fix potential NULL pointer dereferences"
2021-05-26 12:06:54 +02:00
imxfb.c
video: fbdev: imxfb: Fix an error message
2021-07-14 16:56:15 +02:00
Kconfig
fbdev: aty: SPARC64 requires FB_ATY_CT
2021-03-04 11:37:36 +01:00
leo.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
macfb.c
video: fbdev: Replace HTTP links with HTTPS ones
2020-07-20 11:47:29 +02:00
macmodes.c
…
macmodes.h
…
Makefile
drm next for 5.10-rc1
2020-10-15 10:46:16 -07:00
maxinefb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
metronomefb.c
video: fbdev: Replace HTTP links with HTTPS ones
2020-07-20 11:47:29 +02:00
mx3fb.c
fbdev: mx3fb: const pointer to ipu_di_signal_cfg
2020-04-12 22:09:35 +02:00
n411.c
…
neofb.c
video: fbdev: neofb: fix memory leak in neo_scan_monitor()
2020-07-10 16:17:24 +02:00
ocfb.c
video: ocfb: Use devm_platform_ioremap_resource() in ocfb_probe()
2020-01-03 14:27:49 +01:00
offb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
p9100.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
platinumfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
platinumfb.h
…
pm2fb.c
fbdev: fb_pm2fb: Avoid potential divide by zero error
2022-09-05 10:28:56 +02:00
pm3fb.c
treewide: Remove uninitialized_var() usage
2020-07-16 12:35:15 -07:00
pmag-aa-fb.c
drm pull for 5.6-rc1
2020-01-30 08:04:01 -08:00
pmag-ba-fb.c
drm pull for 5.6-rc1
2020-01-30 08:04:01 -08:00
pmagb-b-fb.c
drm pull for 5.6-rc1
2020-01-30 08:04:01 -08:00
ps3fb.c
fbmem: pull fbcon_update_vcs() out of fb_set_var()
2020-08-04 07:37:23 +02:00
pvr2fb.c
video: fbdev: pvr2fb: initialize variables
2020-08-05 19:47:22 +02:00
pxa3xx-gcu.c
video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
2022-09-23 14:17:00 +02:00
pxa3xx-gcu.h
…
pxa168fb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
pxa168fb.h
…
pxafb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
pxafb.h
video: pxafb: Remove cpufreq policy notifier
2019-08-26 10:02:02 +02:00
q40fb.c
mm: don't include asm/pgtable.h if linux/mm.h is already included
2020-06-09 09:39:13 -07:00
s1d13xxxfb.c
fbdev: s1d13xxxfb: add missed unregister_framebuffer in remove
2020-04-17 15:50:12 +02:00
s3c2410fb-regs-lcd.h
fbdev: s3c2410fb: remove mach header dependency
2020-08-20 17:48:12 +02:00
s3c2410fb.c
fbdev: s3c2410fb: remove mach header dependency
2020-08-20 17:48:12 +02:00
s3c2410fb.h
…
s3c-fb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
s3fb.c
video: fbdev: s3fb: Check the size of screen before memset_io()
2022-08-21 15:16:13 +02:00
sa1100fb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
sa1100fb.h
ARM/fbdev: sa11x0: Switch to use GPIO descriptors
2020-04-17 15:50:11 +02:00
sbuslib.c
…
sbuslib.h
…
sh7760fb.c
drm pull for 5.6-rc1
2020-01-30 08:04:01 -08:00
sh_mobile_lcdcfb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
sh_mobile_lcdcfb.h
fbdev/sh_mobile: remove sh_mobile_lcdc_display_notify
2019-06-12 20:28:11 +02:00
simplefb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
skeletonfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
sm501fb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
sm712.h
…
sm712fb.c
video: fbdev: sm712fb: Fix crash in smtcfb_write()
2022-04-08 14:40:36 +02:00
smscufx.c
fbdev: smscufx: Fix several use-after-free bugs
2022-11-03 23:57:49 +09:00
ssd1307fb.c
video: fbdev: ssd1307fb: Added support to Column offset
2020-09-08 13:33:03 +02:00
sstfb.c
video: fbdev: sstfb: replace spurious snprintf() with sprintf()
2020-09-08 13:33:24 +02:00
sticore.h
parisc/stifb: Keep track of hardware path of graphics card
2022-06-09 10:20:49 +02:00
stifb.c
fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
2022-11-10 18:14:21 +01:00
sunxvr500.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
sunxvr1000.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
sunxvr2500.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
tcx.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
tdfxfb.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
tgafb.c
video: fbdev: tgafb: Avoid comma separated statements
2020-09-08 13:33:25 +02:00
tmiofb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
tridentfb.c
drm pull for 5.6-rc1
2020-01-30 08:04:01 -08:00
udlfb.c
video: fbdev: udlfb: properly check endpoint type
2022-05-09 09:05:00 +02:00
uvesafb.c
video: fbdev: uvesafb: fix "noblank" option handling
2020-06-21 09:58:55 +02:00
valkyriefb.c
video: fbdev: valkyriefb.c: fix warning comparing pointer to 0
2020-05-06 21:04:45 +02:00
valkyriefb.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
vesafb.c
video: fbdev: vesafb: add missed release_region
2020-04-17 15:50:14 +02:00
vfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00
vga16fb.c
video: vga16fb: Only probe for EGA and VGA 16 color graphic cards
2022-01-20 09:17:50 +01:00
vt8500lcdfb.c
video: vt8500lcdfb: fix fallthrough warning
2020-04-17 15:50:08 +02:00
vt8500lcdfb.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282
2019-06-05 17:36:37 +02:00
vt8623fb.c
video: fbdev: vt8623fb: Check the size of screen before memset_io()
2022-08-21 15:16:13 +02:00
w100fb.c
video: fbdev: w100fb: Reset global state
2022-04-08 14:40:33 +02:00
w100fb.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
wm8505fb_regs.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282
2019-06-05 17:36:37 +02:00
wm8505fb.c
video: fbdev: wm8505fb: fix sparse warnings about using incorrect types
2020-03-02 16:32:04 +01:00
wmt_ge_rops.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282
2019-06-05 17:36:37 +02:00
wmt_ge_rops.h
…
xen-fbfront.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
xilinxfb.c
video: constify fb ops across all drivers
2019-12-05 10:57:53 +02:00