Dan Carpenter 08a7525811 drm/vmwgfx: Potential off by one in vmw_view_add() ...

commit 0d9cac0ca0 upstream.

The vmw_view_cmd_to_type() function returns vmw_view_max (3) on error.
It's one element beyond the end of the vmw_view_cotables[] table.

My read on this is that it's possible to hit this failure.  header->id
comes from vmw_cmd_check() and it's a user controlled number between
1040 and 1225 so we can hit that error.  But I don't have the hardware
to test this code.

Fixes: d80efd5cb3 ("drm/vmwgfx: Initial DX support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-01-17 09:38:54 +01:00

..

amd

drm: amd: remove broken include path

2017-12-20 10:07:21 +01:00

arc

drm/arcpgu: Accommodate adv7511 switch to DRM bridge

2016-11-11 04:31:35 +03:00

arm

drm: mali-dp: fix Lx_CONTROL register fields clobber

2017-11-15 15:53:13 +01:00

armada

Revert "drm/armada: Fix compile fail"

2017-12-14 09:28:16 +01:00

ast

drm/ast: Handle configuration without P2A bridge

2017-07-05 14:40:17 +02:00

atmel-hlcdc

Merge tag 'v4.8-rc8' into drm-next

2016-09-28 12:08:49 +10:00

bochs

Merge tag 'drm-qemu-20160921' of git://git.kraxel.org/linux into drm-next

2016-09-28 13:23:07 +10:00

bridge

drm/bridge: adv7511: Re-write the i2c address before EDID probing

2017-11-15 15:53:20 +01:00

cirrus

drm/drivers: add support for using the arch wc mapping API.

2016-10-26 16:48:01 +10:00

etnaviv

etnaviv: fix gem object list corruption

2017-10-05 09:44:03 +02:00

exynos

drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU

2017-12-14 09:28:14 +01:00

fsl-dcu

drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume()

2017-12-09 22:01:46 +01:00

gma500

drm/gma500/psb: Actually use VBT mode when it is found

2017-06-07 12:07:49 +02:00

hisilicon

drm/hisilicon: Ensure LDI regs are properly configured.

2017-12-05 11:24:35 +01:00

i2c

Revert "drm/i2c: tda998x: don't register the connector"

2016-09-23 03:29:50 -07:00

i810

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

i915

drm/i915: Prevent zero length "index" write

2017-12-05 11:24:35 +01:00

imx

drm/imx: imx-tve: Do not set the regulator voltage

2017-03-15 10:02:50 +08:00

mediatek

drm/mediatek: don't use drm_put_dev

2017-11-30 08:39:13 +00:00

mga

drm/mga: remove device_is_agp callback

2017-04-12 12:41:20 +02:00

mgag200

gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap

2017-11-21 09:23:26 +01:00

msm

drm/msm: fix an integer overflow test

2017-11-08 10:08:32 +01:00

nouveau

drm/nouveau/mmu: flush tlbs before deleting page tables

2017-10-27 10:38:07 +02:00

omapdrm

drm/omap: fix dmabuf mmap for dma_alloc'ed buffers

2017-12-20 10:07:20 +01:00

panel

drm/panel: simple: Add missing panel_simple_unprepare() calls

2017-12-05 11:24:34 +01:00

qxl

Merge tag 'drm-qemu-20160921' of git://git.kraxel.org/linux into drm-next

2016-09-28 13:23:07 +10:00

r128

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

radeon

drm/radeon: reinstate oland workaround for sclk

2017-12-20 10:07:23 +01:00

rcar-du

drm: rcar-du: Fix H/V sync signal polarity configuration

2017-08-30 10:21:48 +02:00

rockchip

drm/rockchip: analogix_dp: Refuse to enable PSR if panel doesn't support it

2016-10-04 08:23:17 +02:00

savage

drm/savage: dereferencing an error pointer

2017-01-19 20:17:58 +01:00

shmobile

drm/shmobile: make fbdev support really optional

2016-07-18 09:11:37 +02:00

sis

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

sti

drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache

2017-11-21 09:23:23 +01:00

sun4i

drm/sun4i: Fix a return value in case of error

2017-11-30 08:39:10 +00:00

tdfx

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

tegra

drm/tegra: dpaux: Fix error handling

2017-01-19 20:17:58 +01:00

tilcdc

Merge tag 'tilcdc-4.9-3.1' of https://github.com/jsarha/linux into drm-next

2016-09-28 11:17:26 +10:00

ttm

drm/ttm: once more fix ttm_buffer_object_transfer

2017-12-05 11:24:35 +01:00

udl

drm/udl: make control msg static const. (v2)

2016-11-11 08:57:34 +10:00

vc4

drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.

2017-06-24 07:11:14 +02:00

vgem

drm: Don't swallow error codes in drm_dev_alloc()

2016-09-22 04:03:48 -07:00

via

mm: replace get_user_pages() write/force parameters with gup_flags

2016-10-19 08:11:43 -07:00

virtio

drm/virtio: fix framebuffer sparse warning

2017-08-11 08:49:35 -07:00

vmwgfx

drm/vmwgfx: Potential off by one in vmw_view_add()

2018-01-17 09:38:54 +01:00

ati_pcigart.c

…

drm_agpsupport.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_atomic_helper.c

drm: reference count event->completion

2017-03-30 09:41:28 +02:00

drm_atomic.c

drm/atomic: If the atomic check fails, return its value first

2017-08-30 10:21:48 +02:00

drm_auth.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_blend.c

drm/doc: Polish plane composition property docs

2016-09-22 00:04:02 -07:00

drm_bridge.c

drm: Extract drm_bridge.h

2016-09-19 15:04:15 +02:00

drm_bufs.c

GPU-DRM: Replace a kzalloc() call by kcalloc() in drm_legacy_addbufs_sg()

2016-09-21 13:24:27 +02:00

drm_cache.c

drm: Restore double clflush on the last partial cacheline

2016-07-12 15:57:13 +02:00

drm_color_mgmt.c

drm/doc: Document color space handling

2016-09-22 00:04:03 -07:00

drm_connector.c

drm: Don't race connector registration

2017-06-17 06:41:53 +02:00

drm_context.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_crtc_helper_internal.h

drm/fb-helper: Fix sparse warnings

2016-09-19 16:45:15 +02:00

drm_crtc_helper.c

drm/kms-helpers: Extract drm_modeset_helper.[hc]

2016-08-16 16:10:19 +02:00

drm_crtc_internal.h

drm: Extract drm_color_mgmt.[hc]

2016-09-22 00:04:02 -07:00

drm_crtc.c

drm: Extract drm_color_mgmt.[hc]

2016-09-22 00:04:02 -07:00

drm_debugfs.c

gpu: use %pd

2016-08-07 23:38:48 -04:00

drm_dma.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_dp_aux_dev.c

drm: Don't export dp-aux devnode functions

2016-08-16 18:49:26 +02:00

drm_dp_dual_mode_helper.c

drm: Add helper for DP++ adaptors

2016-05-23 11:10:46 +03:00

drm_dp_helper.c

Merge tag 'drm-for-v4.9' of git://people.freedesktop.org/~airlied/linux

2016-10-11 18:12:22 -07:00

drm_dp_mst_topology.c

drm/mst: Avoid processing partially received up/down message transactions

2017-07-27 15:08:07 -07:00

drm_drv.c

drm: drm_minor_register(): Clean up debugfs on failure

2017-11-15 15:53:12 +01:00

drm_edid_load.c

Fix annoyingly awkward typo in drm_edid_load.c

2016-05-30 09:59:28 +02:00

drm_edid.c

drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2

2017-05-25 15:44:48 +02:00

drm_encoder_slave.c

…

drm_encoder.c

drm: Fix typo in encoder docs

2016-09-21 13:33:50 +02:00

drm_fb_cma_helper.c

Merge branch 'for-next' of http://git.agner.ch/git/linux-drm-fsl-dcu into drm-next

2016-07-02 16:21:35 +10:00

drm_fb_helper.c

drm: Cancel drm_fb_helper_resume_work on unload

2017-03-15 10:02:50 +08:00

drm_flip_work.c

…

drm_fops.c

drm: reference count event->completion

2017-03-30 09:41:28 +02:00

drm_fourcc.c

drm: move drm_mode_legacy_fb_format to drm_fourcc.c

2016-08-29 15:37:28 +02:00

drm_framebuffer.c

drm: Extract drm_plane.[hc]

2016-09-22 00:01:56 -07:00

drm_gem_cma_helper.c

drm: Wrap direct calls to driver->gem_free_object from CMA

2016-06-01 15:00:28 +10:00

drm_gem.c

drm: Release driver tracking before making the object available again

2017-08-30 10:21:47 +02:00

drm_global.c

drm: modify drm_global_item_ref to avoid two times of writing ref->object

2016-09-14 15:10:29 -04:00

drm_hashtab.c

drm: fix signed integer overflow

2016-09-06 13:56:41 -04:00

drm_info.c

drm: Print device information again in debugfs

2016-10-17 16:20:53 +10:00

drm_internal.h

drm: drop obsolete drm_core.h

2016-09-19 13:57:38 +02:00

drm_ioc32.c

drm: drop obsolete drm_core.h

2016-09-19 13:57:38 +02:00

drm_ioctl.c

drm: Don't call drm_for_each_crtc with a non-KMS driver

2016-11-30 10:13:00 +01:00

drm_irq.c

drm: avoid uninitialized timestamp use in wait_vblank

2017-01-19 20:18:06 +01:00

drm_kms_helper_common.c

drm: Don't export dp-aux devnode functions

2016-08-16 18:49:26 +02:00

drm_legacy.h

drm: Hide hw.lock cleanup in filp->release better

2016-06-16 10:16:37 +02:00

drm_lock.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_memory.c

drm: Fix broken use of _PAGE_NO_CACHE on powerpc

2016-07-12 13:20:39 +02:00

drm_mipi_dsi.c

drm/dsi: Implement DCS set/get display brightness

2016-08-24 13:34:00 +02:00

drm_mm.c

drm: Apply range restriction after color adjustment when allocation

2017-11-30 08:39:13 +00:00

drm_mode_object.c

drm: Move property validation to a helper, v2.

2016-09-12 10:32:49 -04:00

drm_modes.c

drm: Fix broken VT switch with video=1366x768 option

2017-02-01 08:33:02 +01:00

drm_modeset_helper.c

drm/kms-helpers: Extract drm_modeset_helper.[hc]

2016-08-16 16:10:19 +02:00

drm_modeset_lock.c

drm/doc: Switch to sphinx/rst fixed-width quoting

2016-06-03 20:58:24 +02:00

drm_of.c

…

drm_panel.c

drm/panel: Flesh out kerneldoc

2016-05-06 16:04:48 +02:00

drm_pci.c

drm: Don't swallow error codes in drm_dev_alloc()

2016-09-22 04:03:48 -07:00

drm_plane_helper.c

drm: Fix kerneldoc in drm_plane_helper.c

2016-08-16 18:50:04 +02:00

drm_plane.c

drm: Undo damage to page_flip_ioctl

2016-10-04 12:53:12 +10:00

drm_platform.c

drm: Don't swallow error codes in drm_dev_alloc()

2016-09-22 04:03:48 -07:00

drm_prime.c

drm: Fix up kerneldoc for new drm_gem_dmabuf_export()

2016-10-10 11:19:42 +02:00

drm_probe_helper.c

drm: Schedule the output_poll_work with 1s delay if we have delayed event

2017-02-01 08:33:02 +01:00

drm_property.c

Revert "drm: Unify handling of blob and object properties"

2016-09-07 13:24:22 +03:00

drm_rect.c

drm: Warn about negative sizes when calculating scale factor

2016-08-08 14:17:56 -04:00

drm_scatter.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_simple_kms_helper.c

drm: simple_kms_helper: Add prepare_fb and cleanup_fb hooks

2016-10-05 15:18:02 +02:00

drm_sysfs.c

drm: drop obsolete drm_core.h

2016-09-19 13:57:38 +02:00

drm_trace_points.c

…

drm_trace.h

…

drm_vm.c

drm: Fix broken use of _PAGE_NO_CACHE on powerpc

2016-07-12 13:20:39 +02:00

drm_vma_manager.c

drm: use drm_file to tag vm-bos

2016-09-19 11:22:08 +02:00

Kconfig

Revert "drm: make DRI1 drivers depend on BROKEN"

2016-09-01 06:16:12 +10:00

Makefile

drm: Extract drm_color_mgmt.[hc]

2016-09-22 00:04:02 -07:00