linux/drivers/gpu/drm at linux-5.4.y - linux - Gitea: Git with a cup of tea

michael/linux

Files

History

Ian Forbes e585598450 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

[ Upstream commit 32b415a9dc ]

This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.

Fixes: 8ce75f8ab9 ("drm/vmwgfx: Update device includes for DX device functionality")
Reported-by: Rohit Keshri <rkeshri@redhat.com>
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-12-03 12:45:18 +01:00

..

drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption

2025-12-03 12:45:10 +01:00

…

drm/komeda: Add check for komeda_get_layer_fourcc_list()

2025-03-13 12:43:07 +01:00

drm/armada: Fix off-by-one error in armada_overlay_get_property()

2023-09-23 10:59:46 +02:00

…

drm/ast: Fix DRAM init on AST2200

2023-09-23 10:59:57 +02:00

…

…

drm/bridge: cdns-dsi: Check return value when getting default PHY config

2025-07-17 18:24:55 +02:00

…

drm/etnaviv: fix flush sequence logic

2025-12-03 12:45:05 +01:00

drm/exynos: exynos7_drm_decon: remove ctx->suspended

2025-10-29 13:59:56 +01:00

drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()

2023-01-18 11:41:38 +01:00

drm/gma500: Fix null dereference in hdmi teardown

2025-10-02 13:34:33 +02:00

…

…

…

drm/i915/gt: Fix timeline left held on VMA alloc error

2025-07-17 18:25:00 +02:00

drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()

2024-12-14 19:44:25 +01:00

…

…

drm/lima: set gp bus_stop bit before hard reset

2024-09-04 13:14:55 +02:00

drm/mcde: Enable module autoloading

2024-12-14 19:44:50 +01:00

drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence

2025-06-04 14:32:32 +02:00

drm/meson: fix 1px pink line on GXM when scaling video overlay

2023-03-22 13:28:03 +01:00

…

drm/mgag200: Set DDC timeout in milliseconds

2024-08-19 05:33:53 +02:00

drm/msm/a6xx: Increase HFI response timeout

2025-06-27 11:02:53 +01:00

drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC

2023-03-11 16:43:43 +01:00

drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()

2025-12-03 12:45:08 +01:00

drm/omap: Fix locking in omap_gem_new_dmabuf()

2024-12-14 19:44:25 +01:00

drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep

2024-07-05 09:08:27 +02:00

drm/panfrost: Remove unused id_mask from struct panfrost_model

2024-12-14 19:44:26 +01:00

…

drm/qxl: Add check for drm_cvt_mode

2024-08-19 05:33:32 +02:00

…

drm/radeon/r600_cs: clean up of dead code in r600_cs

2025-10-29 13:59:47 +01:00

drm: rcar-du: Fix memory leak in rcar_du_vsps_init()

2025-06-27 11:02:46 +01:00

drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode

2024-11-08 16:20:29 +01:00

…

drm/sched: Remove optimization that causes hang when killing dependent jobs

2025-08-28 16:21:33 +02:00

…

…

…

drm/sti: remove duplicate object names

2025-05-02 07:39:21 +02:00

drm/stm: Fix an error handling path in stm_drm_platform_probe()

2024-11-08 16:20:28 +01:00

Revert "drm/sun4i: dsi: Change the start delay calculation"

2024-03-01 13:13:35 +01:00

…

drm/tegra: Assign plane type before registration

2025-07-17 18:24:54 +02:00

…

drm/repaper: fix integer overflows in repeat functions

2025-05-02 07:39:21 +02:00

…

…

…

drm/v3d: Disable interrupts before resetting the GPU

2025-07-17 18:24:58 +02:00

drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA

2024-11-08 16:20:50 +01:00

drm/vc4: hdmi: do not return negative values from .get_modes()

2024-04-13 12:51:27 +02:00

drm/vgem: add missing mutex_destroy

2023-05-17 11:35:35 +02:00

…

drm/virtio: Fix GEM handle creation UAF

2023-01-18 11:42:05 +01:00

drm/vkms: Adjust vkms_state->active_planes allocation type

2025-06-27 11:02:46 +01:00

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

2025-12-03 12:45:18 +01:00

…

…

ati_pcigart.c

…

drm_agpsupport.c

…

drm_atomic_helper.c

drm: Add valid clones check

2025-06-04 14:32:34 +02:00

drm_atomic_state_helper.c

…

drm_atomic_uapi.c

drm/atomic: Filter out redundant DPMS calls

2025-04-10 14:29:37 +02:00

drm_atomic.c

drm/atomic: Fix potential use-after-free in nonblocking commits

2023-07-27 08:37:40 +02:00

drm_auth.c

…

drm_blend.c

…

drm_bridge.c

drm/bridge: Rename bridge helpers targeting a bridge chain

2023-03-11 16:43:45 +01:00

drm_bufs.c

…

drm_cache.c

…

drm_client_modeset.c

drm/client: fix null pointer dereference in drm_client_modeset_probe

2024-08-19 05:33:50 +02:00

drm_client.c

…

drm_color_mgmt.c

…

drm_connector.c

drm/atomic: Filter out redundant DPMS calls

2025-04-10 14:29:37 +02:00

drm_context.c

…

drm_crtc_helper_internal.h

…

drm_crtc_helper.c

…

drm_crtc_internal.h

…

drm_crtc.c

drm/crtc: fix uninitialized variable use even harder

2024-11-08 16:20:43 +01:00

drm_damage_helper.c

…

drm_debugfs_crc.c

…

drm_debugfs.c

…

drm_dma.c

…

drm_dp_aux_dev.c

…

drm_dp_cec.c

gpu: drm_dp_cec: fix broken CEC adapter properties check

2025-03-13 12:43:05 +01:00

drm_dp_dual_mode_helper.c

…

drm_dp_helper.c

Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"

2025-09-04 14:05:56 +02:00

drm_dp_mst_topology.c

drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper()

2023-11-08 11:23:38 +01:00

drm_drv.c

drm/drv: propagate errors from drm_modeset_register_all()

2024-01-25 14:34:27 -08:00

drm_dsc.c

…

drm_dumb_buffers.c

…

drm_edid_load.c

…

drm_edid.c

drm/edid: fixed the bug that hdr metadata was not reset

2025-06-04 14:32:35 +02:00

drm_encoder_slave.c

…

drm_encoder.c

drm/bridge: Introduce drm_bridge_get_next_bridge()

2023-03-11 16:43:45 +01:00

drm_fb_cma_helper.c

…

drm_fb_helper.c

drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var

2023-05-17 11:35:31 +02:00

drm_file.c

drm/drm_file: fix use of uninitialized variable

2024-02-23 08:25:00 +01:00

drm_flip_work.c

…

drm_format_helper.c

…

drm_fourcc.c

drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats

2023-03-11 16:43:43 +01:00

drm_framebuffer.c

drm/framebuffer: Fix use of uninitialized variable

2024-02-23 08:25:00 +01:00

drm_gem_cma_helper.c

…

drm_gem_framebuffer_helper.c

…

drm_gem_shmem_helper.c

…

drm_gem_vram_helper.c

drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create

2023-09-23 10:59:56 +02:00

drm_gem.c

…

drm_hashtab.c

…

drm_hdcp.c

…

drm_internal.h

…

drm_ioc32.c

…

drm_ioctl.c

…

drm_irq.c

…

drm_kms_helper_common.c

…

drm_lease.c

…

drm_legacy_misc.c

…

drm_legacy.h

…

drm_lock.c

…

drm_memory.c

…

drm_mipi_dbi.c

…

drm_mipi_dsi.c

Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device"

2024-11-08 16:20:54 +01:00

drm_mm.c

drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused

2024-12-14 19:44:24 +01:00

drm_mode_config.c

…

drm_mode_object.c

…

drm_modes.c

…

drm_modeset_helper.c

…

drm_modeset_lock.c

…

drm_of.c

…

drm_panel_orientation_quirks.c

drm: panel-orientation-quirks: Add new quirk for GPD Win 2

2025-05-02 07:39:12 +02:00

drm_panel.c

drm/panel: Add and fill drm_panel type field

2023-07-27 08:37:29 +02:00

drm_pci.c

…

drm_plane_helper.c

…

drm_plane.c

drm: Don't unref the same fb many times by mistake due to deadlock handling

2024-02-23 08:24:52 +01:00

drm_prime.c

…

drm_print.c

drm/printer: Allow NULL data in devcoredump printer

2024-11-08 16:20:39 +01:00

drm_probe_helper.c

drm/probe-helper: Cancel previous job before starting new one

2023-05-17 11:35:35 +02:00

drm_property.c

…

drm_rect.c

…

drm_scatter.c

…

drm_scdc_helper.c

…

drm_self_refresh_helper.c

…

drm_simple_kms_helper.c

…

drm_syncobj.c

drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set

2024-03-01 13:13:38 +01:00

drm_sysfs.c

…

drm_trace_points.c

…

drm_trace.h

…

drm_vblank.c

drm: Initialize struct drm_crtc_state.no_vblank from device settings

2023-03-11 16:43:46 +01:00

drm_vm.c

…

drm_vma_manager.c

…

drm_vram_helper_common.c

…

drm_vram_mm_helper.c

…

drm_writeback.c

…

Kconfig

…

Makefile

…