Xi Wang 61aff74833 drm: integer overflow in drm_mode_dirtyfb_ioctl() ...

commit a5cd335165 upstream.

There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.

Reported-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2011-12-09 08:52:20 -08:00

..

i2c

drm: Import driver for the sil164 I2C TMDS transmitter.

2010-08-02 10:21:13 +10:00

ttm

Merge branch 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6

2011-04-07 11:14:49 -07:00

drm_buffer.h

drm: Add generic multipart buffer.

2010-02-23 09:46:20 +10:00

drm_cache.h

drm/ttm: consolidate cache flushing code in one place.

2009-08-27 09:53:47 +10:00

drm_core.h

drm: Fix support for PCI domains

2010-08-10 08:20:20 +10:00

drm_crtc_helper.h

drm, kdb, kms: Change mode_set_base_atomic() enter argument to be an enum

2010-10-19 14:13:33 +10:00

drm_crtc.h

drm: Separate EDID Header Check from EDID Block Check

2011-08-15 18:31:34 -07:00

drm_dp_helper.h

drm/radeon/kms: properly set panel mode for eDP

2011-11-11 09:36:54 -08:00

drm_edid.h

drm: parse color format support for digital displays

2011-04-28 14:44:56 +10:00

drm_encoder_slave.h

drm/kms: no need to return void value (encoder)

2009-08-19 16:06:49 +10:00

drm_fb_helper.h

drm: Take lock around probes for drm_fb_helper_hotplug_event

2011-05-16 12:01:43 +10:00

drm_fixed.h

drm: move radeon_fixed.h to shared drm_fixed.h header

2010-05-18 18:21:33 +10:00

drm_global.h

drm: move ttm global code to core drm

2010-08-04 09:46:06 +10:00

drm_hashtab.h

drm: Remove unused members from struct drm_open_hash

2011-02-23 11:16:40 +10:00

drm_mem_util.h

drm/ttm: use drm calloc large and free large

2010-03-15 10:31:43 +10:00

drm_memory.h

includecheck fix: include/drm, drm_memory.h

2009-09-20 16:02:58 +05:30

drm_mm.h

drm: mm: fix debug output

2011-05-09 09:14:45 +10:00

drm_mode.h

drm: integer overflow in drm_mode_dirtyfb_ioctl()

2011-12-09 08:52:20 -08:00

drm_os_linux.h

drm/i915: add i915_lp_ring_sync helper

2009-11-05 14:47:07 -08:00

drm_pciids.h

drm/radeon: add some missing FireMV pci ids

2011-11-21 14:31:19 -08:00

drm_sarea.h

drm: move to kref per-master structures.

2008-12-29 17:47:22 +10:00

drm_sman.h

…

drm_sysfs.h

drm: Enable drm drivers to add drm sysfs devices.

2009-08-19 16:08:51 +10:00

drm_usb.h

drm: add usb framework

2011-02-07 13:09:42 +10:00

drm.h

drm/vblank: update recently added vbl interface to be more future proof.

2011-03-24 21:28:46 +10:00

drmP.h

drm: Export the command-line mode parser

2011-04-28 14:56:23 +10:00

i810_drm.h

…

i915_drm.h

drm/i915: Fix typo in DRM_I915_OVERLAY_PUT_IMAGE ioctl define

2011-08-15 18:31:35 -07:00

intel-gtt.h

intel-gtt: export api for drm/i915

2010-11-23 20:14:47 +00:00

Kbuild

drm: remove i830 driver

2011-02-07 12:14:18 +10:00

mga_drm.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

nouveau_drm.h

drm/nv50: support for compression

2011-02-25 06:46:07 +10:00

r128_drm.h

…

radeon_drm.h

drm/radeon/kms: fix gart setup on fusion parts (v2)

2011-05-04 10:16:40 +10:00

savage_drm.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

sis_drm.h

…

via_drm.h

drm: Add compatibility #ifdefs for *BSD

2009-12-04 08:59:28 +10:00

vmwgfx_drm.h

Fix common misspellings

2011-03-31 11:26:23 -03:00