Dan Rosenberg d912e785e2 drivers/video/via/ioctl.c: prevent reading uninitialized stack memory ...

commit b4aaa78f4c upstream.

The VIAFB_GET_INFO device ioctl allows unprivileged users to read 246
bytes of uninitialized stack memory, because the "reserved" member of
the viafb_ioctl_info struct declared on the stack is not altered or
zeroed before being copied back to the user.  This patch takes care of
it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2010-09-26 17:21:31 -07:00

..

aty

atyfb: coding style cleanup

2009-09-23 07:39:50 -07:00

backlight

backlight: mbp_nvidia_bl - add five more MacBook variants

2010-04-26 07:41:19 -07:00

console

fb: remove fb_save_state() and fb_restore_state operations

2009-11-12 07:25:56 -08:00

display

…

geode

gx1fb: properly alloc cmap and plug cmap leak

2009-02-11 14:25:34 -08:00

i810

i810fb: fix regression with uninitalized fb_info->mm_lock mutex

2009-07-08 09:19:49 -07:00

intelfb

intelfb: fix a bug when changing video timing

2009-06-16 19:48:00 -07:00

kyro

…

logo

fbdev: move logo externs to header file

2009-06-16 19:47:57 -07:00

matrox

matroxfb: fix problems with display stability

2009-12-18 14:05:32 -08:00

mb862xx

mb862xxfb: use CONFIG_OF instead of CONFIG_PPC_OF

2009-06-16 19:47:59 -07:00

mbx

…

msm

drivers/video/msm: update to new kernel

2009-11-12 07:26:00 -08:00

nvidia

nvidiafb: fix boot-time printk string

2009-06-23 12:50:05 -07:00

omap

omapfb: Blizzard: constify register address tables

2009-10-06 08:31:50 -07:00

pnx4008

…

riva

…

savage

savagefb: fix blanking mode on CRT display

2009-11-12 07:25:56 -08:00

sis

drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory

2010-09-26 17:21:27 -07:00

vermilion

…

via

drivers/video/via/ioctl.c: prevent reading uninitialized stack memory

2010-09-26 17:21:31 -07:00

68328fb.c

68328fb: fix cmap memory leaks

2009-04-01 08:59:31 -07:00

acornfb.c

acornfb: remove fb_mmap function

2009-06-16 19:47:59 -07:00

acornfb.h

…

amba-clcd.c

Remove multiple KERN_ prefixes from printk formats

2009-07-08 10:30:03 -07:00

amifb.c

amifb: check fb_alloc_cmap return value and handle failure properly

2009-04-01 08:59:31 -07:00

arcfb.c

…

arkfb.c

arkfb: fix misplaced parentheses

2009-04-01 08:59:32 -07:00

asiliantfb.c

asiliantfb: add missing return statement

2009-04-21 13:41:47 -07:00

atafb_iplan2p2.c

…

atafb_iplan2p4.c

…

atafb_iplan2p8.c

…

atafb_mfb.c

…

atafb_utils.h

…

atafb.c

fb: remove fb_save_state() and fb_restore_state operations

2009-11-12 07:25:56 -08:00

atafb.h

…

atmel_lcdfb.c

atmel_lcdfb: new alternate pixel clock formula

2009-11-12 07:25:57 -08:00

au1100fb.c

drivers/video: add kmalloc NULL tests

2009-09-23 07:39:56 -07:00

au1100fb.h

…

au1200fb.c

platform driver: fix incorrect use of 'platform_bus_type' with 'struct device_driver'

2009-03-24 16:38:25 -07:00

au1200fb.h

…

bf54x-lq043fb.c

fbdev: bf54x-lq043fb: use kzalloc over kmalloc/memset

2009-06-16 19:48:03 -07:00

bfin-t350mcqb-fb.c

fbdev: bfin-t350mcqb-fb: fix fbmem allocation with blanking lines

2010-05-26 14:29:14 -07:00

broadsheetfb.c

[ARM] 5353/1: fbdev: add E-Ink Broadsheet controller support v3

2009-02-10 11:27:59 +00:00

bt431.h

…

bt455.h

…

bw2.c

bw2: use standard fields for framebuffer physical address and length

2009-06-16 04:56:30 -07:00

c2p_core.h

fbdev: c2p/atafb - Add support for Atari interleaved bitplanes

2009-01-12 20:56:31 +01:00

c2p_iplan2.c

fbdev: c2p/atafb - Add support for Atari interleaved bitplanes

2009-01-12 20:56:31 +01:00

c2p_planar.c

fbdev: c2p - Rename c2p to c2p_planar

2009-01-12 20:56:32 +01:00

c2p.h

fbdev: c2p - Rename c2p to c2p_planar

2009-01-12 20:56:32 +01:00

carminefb_regs.h

…

carminefb.c

carminefb: fix possible access beyond end of carmine_modedb[]

2009-06-16 19:47:59 -07:00

carminefb.h

…

cfbcopyarea.c

trivial: remove unnecessary semicolons

2009-09-21 15:14:58 +02:00

cfbfillrect.c

fbdev: fix fillrect for 24bpp modes

2009-05-06 16:36:10 -07:00

cfbimgblt.c

…

cg3.c

cg3: use standard fields for framebuffer physical address and length

2009-06-16 04:56:34 -07:00

cg6.c

cg6: use standard fields for framebuffer physical address and length

2009-06-16 04:56:35 -07:00

cg14.c

cg14: use standard fields for framebuffer physical address and length

2009-06-16 04:56:31 -07:00

chipsfb.c

chipsfb: remove redundant assignment

2009-06-16 19:47:58 -07:00

cirrusfb.c

cirrusfb: do not allow unsupported pixel depth

2009-04-13 15:04:30 -07:00

clps711xfb.c

…

cobalt_lcdfb.c

Update Yoichi Yuasa's e-mail address

2009-07-03 15:45:29 +01:00

controlfb.c

powerpc/mm: Rework usage of _PAGE_COHERENT/NO_CACHE/GUARDED

2008-12-21 14:21:16 +11:00

controlfb.h

…

cyber2000fb.c

cyber2000fb.c: use proper method for stopping unload if CONFIG_ARCH_SHARK

2009-06-12 21:46:53 +09:30

cyber2000fb.h

…

da8xx-fb.c

davinci: fb: fix frame buffer driver issues

2009-12-01 16:32:19 -08:00

dnfb.c

…

edid.h

…

efifb.c

efifb: fix framebuffer handoff

2010-04-01 15:58:13 -07:00

ep93xx-fb.c

ep93xx video driver

2009-09-23 07:39:51 -07:00

epson1355fb.c

…

fb_ddc.c

…

fb_defio.c

const: mark struct vm_struct_operations

2009-09-27 11:39:25 -07:00

fb_draw.h

fbdev: fix fillrect for 24bpp modes

2009-05-06 16:36:10 -07:00

fb_notify.c

…

fb_sys_fops.c

…

fbcmap.c

fbmem: don't call copy_from/to_user() with mutex held

2009-02-05 12:56:46 -08:00

fbcvt.c

…

fbmem.c

Merge branch 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

2009-09-30 08:03:00 -07:00

fbmon.c

fbmon: work around compiler bug in gcc-2.4.2

2009-07-22 08:49:22 -07:00

fbsysfs.c

Revert "fb: Initialize fb_info mutexes in framebuffer_alloc()"

2009-07-08 09:20:11 -07:00

ffb.c

…

fm2fb.c

…

fsl-diu-fb.c

fsl-diu-fb: fix regression with uninitalized fb_info->mm_lock mutex

2009-07-08 14:18:35 -07:00

fsl-diu-fb.h

…

g364fb.c

…

gbefb.c

VIDEO: Correct use of request_region/request_mem_region

2009-12-02 23:58:32 +00:00

gxt4500.c

pci: use pci_ioremap_bar() in drivers/video

2009-01-06 15:59:26 -08:00

hecubafb.c

…

hgafb.c

…

hitfb.c

video: hitfb: Move over to dev_pm_ops.

2009-07-07 11:50:57 +09:00

hpfb.c

…

igafb.c

igafb: use framebuffer_alloc() to allocate fb_info struct

2009-06-16 19:47:58 -07:00

imsttfb.c

…

imxfb.c

imxfb: correct location of callbacks in suspend and resume

2010-02-09 04:51:00 -08:00

Kconfig

fb: put framebuffer drivers back under the "frame buffer devices" menu

2009-11-12 07:25:58 -08:00

leo.c

leo: use standard fields for framebuffer physical address and length

2009-06-16 04:56:37 -07:00

macfb.c

macfb annotations and compiler warning fix

2008-12-28 20:00:05 +01:00

macmodes.c

…

macmodes.h

…

Makefile

ep93xx video driver

2009-09-23 07:39:51 -07:00

maxinefb.c

…

metronomefb.c

…

modedb.c

fbdev: add video modes for resolutions and timings of PAL RGB

2009-06-16 19:47:58 -07:00

mx3fb.c

mx3fb: some debug and initialisation fixes

2010-02-09 04:51:00 -08:00

n411.c

…

neofb.c

neofb: fix sparse warnings

2009-01-06 15:59:27 -08:00

offb.c

offb: Add support for framebuffer handoff to offb.

2010-03-15 08:49:42 -07:00

output.c

video: struct device - replace bus_id with dev_name(), dev_set_name()

2009-01-06 10:44:35 -08:00

p9100.c

p9100: use standard fields for framebuffer physical address and length

2009-06-16 04:56:38 -07:00

platinumfb.c

platinumfb: fix misplaced parenthesis

2009-09-23 07:39:50 -07:00

platinumfb.h

…

pm2fb.c

fbdev: use framebuffer_release() for freeing fb_info structures

2009-06-16 19:48:00 -07:00

pm3fb.c

pm3fb: fix sparse warning

2009-01-06 15:59:27 -08:00

pmag-aa-fb.c

…

pmag-ba-fb.c

video: struct device - replace bus_id with dev_name(), dev_set_name()

2009-03-24 16:38:21 -07:00

pmagb-b-fb.c

video: struct device - replace bus_id with dev_name(), dev_set_name()

2009-03-24 16:38:21 -07:00

ps3fb.c

powerpc/cell: Move CBE_IOPTE_* to <asm/cell-regs.h>

2009-08-20 10:29:26 +10:00

pvr2fb.c

sh: dma: Make PVR2 DMA configurable.

2009-03-17 09:30:36 +09:00

pxa168fb.c

fb: add support of LCD display controller on pxa168/910 (base layer)

2009-06-13 00:09:09 +08:00

pxa168fb.h

fb: add support of LCD display controller on pxa168/910 (base layer)

2009-06-13 00:09:09 +08:00

pxafb.c

[ARM] pxafb: add accelerator ID for PXA3xx GCU

2009-09-12 00:16:27 +08:00

pxafb.h

[ARM] pxafb: add support for overlay1 and overlay2 as framebuffer devices

2008-12-29 18:00:04 +08:00

q40fb.c

…

s1d13xxxfb.c

fbdev: s1d13xxxfb: add accelerated bitblt functions

2009-06-16 19:48:00 -07:00

s3c2410fb.c

s3c2410fb: fix clockrate calculation

2009-09-23 07:39:56 -07:00

s3c2410fb.h

s3c-fb: CPUFREQ frequency scaling support

2009-06-16 19:47:59 -07:00

s3c-fb.c

revert "drivers/video/s3c-fb.c: fix clock setting for Samsung SoC Framebuffer"

2010-01-22 15:17:59 -08:00

s3fb.c

s3fb: fix color component length for pseudocolor modes

2009-04-13 15:04:29 -07:00

sa1100fb.c

Nicolas Pitre has a new email address

2009-09-15 09:37:12 -07:00

sa1100fb.h

sa1100fb: fix color component length for pseudocolor modes

2009-04-13 15:04:29 -07:00

sbuslib.c

…

sbuslib.h

…

sgivwfb.c

drivers/video/sgivwfb.c: fix memory leaks in removal path

2009-04-01 08:59:30 -07:00

sh7760fb.c

fbdev: add mutex for fb_mmap locking

2009-06-30 18:56:00 -07:00

sh_mobile_lcdcfb.c

video: sh_mobile_lcdcfb: use both register sets for display panning

2009-09-15 21:08:22 +09:00

skeletonfb.c

fbdev: fix color component field length documentation

2009-04-13 15:04:29 -07:00

sm501fb.c

sm501fb: fix regression with uninitalized fb_info->mm_lock mutex

2009-07-09 20:44:44 -07:00

sstfb.c

sstfb: check fb_alloc_cmap return value and handle failure properly

2009-04-01 08:59:30 -07:00

sticore.h

…

stifb.c

Remove multiple KERN_ prefixes from printk formats

2009-07-08 10:30:03 -07:00

sunxvr500.c

sunxvr500: Ignore secondary output PCI devices.

2010-08-26 16:41:48 -07:00

sunxvr2500.c

…

svgalib.c

…

syscopyarea.c

…

sysfillrect.c

fbdev: fix fillrect for 24bpp modes

2009-05-06 16:36:10 -07:00

sysimgblt.c

…

tcx.c

tcx: use standard fields for framebuffer physical address and length

2009-06-16 19:48:00 -07:00

tdfxfb.c

i2c: Do not probe for TV chips on Voodoo3 adapters

2009-06-15 18:01:48 +02:00

tgafb.c

tgafb: fix cmap memory leak

2009-04-01 08:59:31 -07:00

tmiofb.c

drivers/video/tmiofb.c: fix uninitialised return value

2009-09-23 07:39:57 -07:00

tridentfb.c

tridentfb: delete acceleration Kconfig option

2009-04-01 08:59:34 -07:00

uvesafb.c

fb: remove fb_save_state() and fb_restore_state operations

2009-11-12 07:25:56 -08:00

valkyriefb.c

valkyriefb: check fb_alloc_cmap return value and handle failure properly

2009-04-01 08:59:31 -07:00

valkyriefb.h

…

vesafb.c

fbdev: add support for handoff from firmware to hw framebuffers

2009-06-16 19:48:00 -07:00

vfb.c

fbdev: fix color component field length documentation

2009-04-13 15:04:29 -07:00

vga16fb.c

…

vgastate.c

…

vt8623fb.c

…

w100fb.c

drivers/video/w100fb.c: ignore void return value / fix build failure

2010-08-13 13:19:35 -07:00

w100fb.h

…

xen-fbfront.c

xenfb: connect to backend before registering fb

2009-08-27 12:31:18 -07:00

xilinxfb.c

fbdev/xilinxfb: Fix improper casting and tighen up probe path

2009-06-17 00:30:02 -06:00