linux-stable.git/drivers/video/fbdev/omap2, branch v3.16.65 Linux kernel stable tree fbdev/omapfb: fix omapfb_memory_read infoleak 2018-12-16T22:09:26+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2018-09-26T16:11:22+00:00 ddbdc753f5567d04571669f30ffe622b17d07fe0 commit 1bafcbf59fed92af58955024452f45430d3898c5 upstream. OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies them to a userspace buffer. The code has two issues: - The user provided width and height could be large enough to overflow the calculations - The copy_to_user() can copy uninitialized memory to the userspace, which might contain sensitive kernel information. Fix these by limiting the width & height parameters, and only copying the amount of data that we actually received from the LCD. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reported-by: Jann Horn <jannh@google.com> Cc: security@kernel.org Cc: Will Deacon <will.deacon@arm.com> Cc: Jann Horn <jannh@google.com> Cc: Tony Lindgren <tony@atomide.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit 1bafcbf59fed92af58955024452f45430d3898c5 upstream.

OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies
them to a userspace buffer. The code has two issues:

- The user provided width and height could be large enough to overflow
  the calculations
- The copy_to_user() can copy uninitialized memory to the userspace,
  which might contain sensitive kernel information.

Fix these by limiting the width & height parameters, and only copying
the amount of data that we actually received from the LCD.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reported-by: Jann Horn <jannh@google.com>
Cc: security@kernel.org
Cc: Will Deacon <will.deacon@arm.com>
Cc: Jann Horn <jannh@google.com>
Cc: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
video: omapdss: Fix potential null pointer dereference 2014-06-26T11:40:15+00:00 Sachin Kamat sachin.kamat@linaro.org 2014-05-30T10:26:34+00:00 06f7d7931752ee1bd0903a38b1086c7ea5e10cdf kmalloc can return null. Add a check to avoid potential null pointer dereference error when the pointer is accessed later. Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> 
kmalloc can return null. Add a check to avoid potential null
pointer dereference error when the pointer is accessed later.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
OMAPDSS: move 'compatible' converter to omapdss driver 2014-05-28T06:25:15+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2014-05-15T07:41:34+00:00 f2dd36ac9974cc2353bcbb8e6b643fb96030564c Move the panel/encoder driver compatible-string converter from arch/arm/mach-omap2/display.c to omapdss driver. That is a more logical place for it, as it's really an omapdss internal hack. The code is rewritten to follow the video node graph, starting from omapdss. This removes the need to have the device compatible-string database. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> 
Move the panel/encoder driver compatible-string converter from
arch/arm/mach-omap2/display.c to omapdss driver. That is a more logical
place for it, as it's really an omapdss internal hack.

The code is rewritten to follow the video node graph, starting from
omapdss. This removes the need to have the device compatible-string
database.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
OMAPDSS: HDMI: fix devm_ioremap_resource error checks 2014-05-23T11:50:09+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2014-05-23T11:50:09+00:00 2b22df835ba42ad6c5f09a52baf68cfb60650f56 devm_ioremap_resource returns ERR_PTR on error, not NULL. Fix the error checks in the driver. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> 
devm_ioremap_resource returns ERR_PTR on error, not NULL. Fix the
error checks in the driver.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
OMAPDSS: HDMI: remove unused defines 2014-05-23T11:40:47+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2014-05-23T11:40:47+00:00 2dcfdc3066e51a2143ed99f2a17ba2f1f32d42b7 Remove some unused defines from the HDMI driver. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> 
Remove some unused defines from the HDMI driver.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
OMAPDSS: HDMI: cleanup WP ioremaps 2014-05-23T11:37:44+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2014-05-23T11:37:44+00:00 fc2daf3b1df0fd751df7dd16652f45fa407bd1cb Commit 59b3d38a3691396783df108e6afbba30656edccb missed cleaning up the hdmi_wp.c file. Clean up hdmi_wp.c the same way as the others. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> 
Commit 59b3d38a3691396783df108e6afbba30656edccb missed cleaning up the
hdmi_wp.c file.

Clean up hdmi_wp.c the same way as the others.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
OMAPDSS: panel NEC-NL8048HL11 DT support 2014-05-20T11:39:47+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2014-05-16T09:39:29+00:00 b36250d8b5a390ffc395c9c2cd5c39f722a276f4 We don't have any working boards using this panel right now, and the panel driver looks odd compared to the panel specs. For example, the panel spec does not mention any QVGA pin. So, while this patch adds DT support to the driver, it's not really supported and there are not bindings documentation for the panel until someone can verify how the panel actually works. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Erik Gilling <konkers@android.com> 
We don't have any working boards using this panel right now, and the
panel driver looks odd compared to the panel specs. For example, the
panel spec does not mention any QVGA pin.

So, while this patch adds DT support to the driver, it's not really
supported and there are not bindings documentation for the panel until
someone can verify how the panel actually works.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Erik Gilling <konkers@android.com>
OMAPDSS: Panel TPO-TD043MTEA1 DT support 2014-05-20T11:39:46+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2014-05-16T09:28:36+00:00 597cc1e451cb984653b484be1da47bdc3c63ff0e Add DT support for panel TPO-TD043MTEA1. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Grazvydas Ignotas <notasas@gmail.com> 
Add DT support for panel TPO-TD043MTEA1.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Grazvydas Ignotas <notasas@gmail.com>
OMAPDSS: panel sharp-ls037v7dw01 DT support 2014-05-20T11:39:45+00:00 Tony Lindgren tony@atomide.com 2014-05-16T06:45:09+00:00 be88c16a22ed92e8d7b6dc27f578eb3b43f696dc Add DT support for sharp-ls037v7dw01. Signed-off-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> 
Add DT support for sharp-ls037v7dw01.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
OMAPDSS: panel-sharp-ls037v7dw01: update to use gpiod 2014-05-20T11:39:45+00:00 Tony Lindgren tony@atomide.com 2014-04-29T03:22:20+00:00 9522f9fe86f9df7203ca0b649bf5eda912e899c1 Using gpiod will make it easier to add device tree support for this panel in the following patches. Note that all the GPIOs for this panel are optional, any of the the GPIOs could be configured with external pulls instead of GPIOs, so let's not error out if GPIOs are not found to make the panel more generic. Signed-off-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> 
Using gpiod will make it easier to add device tree support
for this panel in the following patches.

Note that all the GPIOs for this panel are optional, any
of the the GPIOs could be configured with external pulls
instead of GPIOs, so let's not error out if GPIOs are not
found to make the panel more generic.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>