1. 30 Nov, 2020 1 commit
  2. 29 Nov, 2020 2 commits
  3. 26 Nov, 2020 4 commits
  4. 25 Nov, 2020 1 commit
  5. 23 Nov, 2020 2 commits
  6. 19 Nov, 2020 10 commits
  7. 18 Nov, 2020 1 commit
  8. 17 Nov, 2020 1 commit
  9. 12 Nov, 2020 1 commit
  10. 10 Nov, 2020 1 commit
  11. 09 Nov, 2020 2 commits
    • Thomas Zimmermann's avatar
      drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[] · 06ad8d33
      Thomas Zimmermann authored
      The gma500 driver expects 3 pipelines in several it's IRQ functions.
      Accessing struct drm_device.vblank[], this fails with devices that only
      have 2 pipelines. An example KASAN report is shown below.
      
        [   62.267688] ==================================================================
        [   62.268856] BUG: KASAN: slab-out-of-bounds in psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.269450] Read of size 1 at addr ffff8880012bc6d0 by task systemd-udevd/285
        [   62.269949]
        [   62.270192] CPU: 0 PID: 285 Comm: systemd-udevd Tainted: G            E     5.10.0-rc1-1-default+ #572
        [   62.270807] Hardware name:  /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012
        [   62.271366] Call Trace:
        [   62.271705]  dump_stack+0xae/0xe5
        [   62.272180]  print_address_description.constprop.0+0x17/0xf0
        [   62.272987]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.273474]  __kasan_report.cold+0x20/0x38
        [   62.273989]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.274460]  kasan_report+0x3a/0x50
        [   62.274891]  psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
        [   62.275380]  drm_irq_install+0x131/0x1f0
        <...>
        [   62.300751] Allocated by task 285:
        [   62.301223]  kasan_save_stack+0x1b/0x40
        [   62.301731]  __kasan_kmalloc.constprop.0+0xbf/0xd0
        [   62.302293]  drmm_kmalloc+0x55/0x100
        [   62.302773]  drm_vblank_init+0x77/0x210
      
      Resolve the issue by only handling vblank entries up to the number of
      CRTCs.
      
      I'm adding a Fixes tag for reference, although the bug has been present
      since the driver's initial commit.
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Fixes: 5c49fd3a ("gma500: Add the core DRM files and headers")
      Cc: Alan Cox <alan@linux.intel.com>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
      Cc: dri-devel@lists.freedesktop.org
      Cc: stable@vger.kernel.org#v3.3+
      Link: https://patchwork.freedesktop.org/patch/msgid/20201105190256.3893-1-tzimmermann@suse.de
      06ad8d33
    • Olaf Hering's avatar
      video: hyperv_fb: include vmalloc.h · 34a28083
      Olaf Hering authored
      hvfb_getmem uses vzalloc, therefore vmalloc.h should be included.
      
      Fixes commit d21987d7 ("video: hyperv:
      hyperv_fb: Support deferred IO for Hyper-V frame buffer driver")
      Signed-off-by: default avatarOlaf Hering <olaf@aepfle.de>
      Signed-off-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20201106183941.9751-1-olaf@aepfle.de
      34a28083
  12. 08 Nov, 2020 1 commit
  13. 03 Nov, 2020 4 commits
  14. 02 Nov, 2020 6 commits
  15. 01 Nov, 2020 3 commits