linux-stable.git/drivers/video/fbdev/omap2, branch v3.16.78

omap2fb: Fix stack memory disclosure

2019-05-02T20:41:19+00:00

commit a01421e4484327fe44f8e126793ed5a48a221e24 upstream.

Using [1] for static analysis I found that the OMAPFB_QUERY_PLANE,
OMAPFB_GET_COLOR_KEY, OMAPFB_GET_DISPLAY_INFO, and OMAPFB_GET_VRAM_INFO
cases could all leak uninitialized stack memory--either due to
uninitialized padding or 'reserved' fields.

Fix them by clearing the shared union used to store copied out data.

[1] https://github.com/vlad902/kernel-uninitialized-memory-checker

Signed-off-by: Vlad Tsyrklevich 
Reviewed-by: Kees Cook 
Fixes: b39a982ddecf ("OMAP: DSS2: omapfb driver")
Cc: security@kernel.org
[b.zolnierkie: prefix patch subject with "omap2fb: "]
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Ben Hutchings

fbdev/omapfb: fix omapfb_memory_read infoleak

2018-12-16T22:09:26+00:00

commit 1bafcbf59fed92af58955024452f45430d3898c5 upstream.

OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies
them to a userspace buffer. The code has two issues:

- The user provided width and height could be large enough to overflow
  the calculations
- The copy_to_user() can copy uninitialized memory to the userspace,
  which might contain sensitive kernel information.

Fix these by limiting the width & height parameters, and only copying
the amount of data that we actually received from the LCD.

Signed-off-by: Tomi Valkeinen 
Reported-by: Jann Horn 
Cc: security@kernel.org
Cc: Will Deacon 
Cc: Jann Horn 
Cc: Tony Lindgren 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Ben Hutchings

video: omapdss: Fix potential null pointer dereference

2014-06-26T11:40:15+00:00

kmalloc can return null. Add a check to avoid potential null
pointer dereference error when the pointer is accessed later.

Signed-off-by: Sachin Kamat 
Signed-off-by: Tomi Valkeinen

OMAPDSS: move 'compatible' converter to omapdss driver

2014-05-28T06:25:15+00:00

Move the panel/encoder driver compatible-string converter from
arch/arm/mach-omap2/display.c to omapdss driver. That is a more logical
place for it, as it's really an omapdss internal hack.

The code is rewritten to follow the video node graph, starting from
omapdss. This removes the need to have the device compatible-string
database.

Signed-off-by: Tomi Valkeinen

OMAPDSS: HDMI: fix devm_ioremap_resource error checks

2014-05-23T11:50:09+00:00

devm_ioremap_resource returns ERR_PTR on error, not NULL. Fix the
error checks in the driver.

Signed-off-by: Tomi Valkeinen

OMAPDSS: HDMI: remove unused defines

2014-05-23T11:40:47+00:00

Remove some unused defines from the HDMI driver.

Signed-off-by: Tomi Valkeinen

OMAPDSS: HDMI: cleanup WP ioremaps

2014-05-23T11:37:44+00:00

Commit 59b3d38a3691396783df108e6afbba30656edccb missed cleaning up the
hdmi_wp.c file.

Clean up hdmi_wp.c the same way as the others.

Signed-off-by: Tomi Valkeinen

OMAPDSS: panel NEC-NL8048HL11 DT support

2014-05-20T11:39:47+00:00

We don't have any working boards using this panel right now, and the
panel driver looks odd compared to the panel specs. For example, the
panel spec does not mention any QVGA pin.

So, while this patch adds DT support to the driver, it's not really
supported and there are not bindings documentation for the panel until
someone can verify how the panel actually works.

Signed-off-by: Tomi Valkeinen 
Cc: Erik Gilling

OMAPDSS: Panel TPO-TD043MTEA1 DT support

2014-05-20T11:39:46+00:00

Add DT support for panel TPO-TD043MTEA1.

Signed-off-by: Tomi Valkeinen 
Cc: Grazvydas Ignotas

OMAPDSS: panel sharp-ls037v7dw01 DT support

2014-05-20T11:39:45+00:00

Add DT support for sharp-ls037v7dw01.

Signed-off-by: Tony Lindgren 
Signed-off-by: Tomi Valkeinen