Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=linux-4.20.y 2019-01-22T20:09:55+00:00 2019-01-22T20:09:55+00:00 Vlad Tsyrklevich vlad@tsyrklevich.net 2019-01-11T13:34:38+00:00 urn:sha1:f134f703dd8a1a93b8f59e7610062dfab90a771c commit a01421e4484327fe44f8e126793ed5a48a221e24 upstream. Using [1] for static analysis I found that the OMAPFB_QUERY_PLANE, OMAPFB_GET_COLOR_KEY, OMAPFB_GET_DISPLAY_INFO, and OMAPFB_GET_VRAM_INFO cases could all leak uninitialized stack memory--either due to uninitialized padding or 'reserved' fields. Fix them by clearing the shared union used to store copied out data. [1] https://github.com/vlad902/kernel-uninitialized-memory-checker Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net> Reviewed-by: Kees Cook <keescook@chromium.org> Fixes: b39a982ddecf ("OMAP: DSS2: omapfb driver") Cc: security@kernel.org [b.zolnierkie: prefix patch subject with "omap2fb: "] Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2018-10-24T09:26:32+00:00 Bartlomiej Zolnierkiewicz b.zolnierkie@samsung.com 2018-10-24T09:26:32+00:00 urn:sha1:217188d9f985bd3ce8c9a0cd50ca35be62d0f8c6 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Acked-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> 2018-09-26T16:11:22+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2018-09-26T16:11:22+00:00 urn:sha1:1bafcbf59fed92af58955024452f45430d3898c5 OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies them to a userspace buffer. The code has two issues: - The user provided width and height could be large enough to overflow the calculations - The copy_to_user() can copy uninitialized memory to the userspace, which might contain sensitive kernel information. Fix these by limiting the width & height parameters, and only copying the amount of data that we actually received from the LCD. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Reported-by: Jann Horn <jannh@google.com> Cc: stable@vger.kernel.org Cc: security@kernel.org Cc: Will Deacon <will.deacon@arm.com> Cc: Jann Horn <jannh@google.com> Cc: Tony Lindgren <tony@atomide.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> 2018-08-23T22:44:58+00:00 Linus Torvalds torvalds@linux-foundation.org 2018-08-23T22:44:58+00:00 urn:sha1:06e386a1db54ab6a671e103e929b590f7a88f0e3 Pull fbdev updates from Bartlomiej Zolnierkiewicz: "Mostly small fixes and cleanups for fb drivers (the biggest updates are for udlfb and pxafb drivers). This also adds deferred console takeover support to the console code and efifb driver. Summary: - add support for deferred console takeover, when enabled defers fbcon taking over the console from the dummy console until the first text is displayed on the console - together with the "quiet" kernel commandline option this allows fbcon to still be used together with a smooth graphical bootup (Hans de Goede) - improve console locking debugging code (Thomas Zimmermann) - copy the ACPI BGRT boot graphics to the framebuffer when deferred console takeover support is used in efifb driver (Hans de Goede) - update udlfb driver - fix lost console when the user unplugs a USB adapter, fix the screen corruption issue, fix locking and add some performance optimizations (Mikulas Patocka) - update pxafb driver - fix using uninitialized memory, switch to devm_* API, handle initialization errors and add support for lcd-supply regulator (Daniel Mack) - add support for boards booted with a DeviceTree in pxa3xx_gcu driver (Daniel Mack) - rename omap2 module to omap2fb.ko to avoid conflicts with omap1 driver (Arnd Bergmann) - enable ACPI-based enumeration for goldfishfb driver (Yu Ning) - fix goldfishfb driver to make user space Android code use 60 fps (Christoffer Dall) - print big fat warning when nomodeset kernel parameter is used in vgacon driver (Lyude Paul) - remove VLA usage from fsl-diu-fb driver (Kees Cook) - misc fixes (Julia Lawall, Geert Uytterhoeven, Fredrik Noring, Yisheng Xie, Dan Carpenter, Daniel Vetter, Anton Vasilyev, Randy Dunlap, Gustavo A. R. Silva, Colin Ian King, Fengguang Wu) - misc cleanups (Roman Kiryanov, Yisheng Xie, Colin Ian King)" * tag 'fbdev-v4.19' of https://github.com/bzolnier/linux: (54 commits) Documentation/fb: corrections for fbcon.txt fbcon: Do not takeover the console from atomic context dummycon: Stop exporting dummycon_[un]register_output_notifier fbcon: Only defer console takeover if the current console driver is the dummycon fbcon: Only allow FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER if fbdev is builtin fbdev: omap2: omapfb: fix ifnullfree.cocci warnings fbdev: omap2: omapfb: fix bugon.cocci warnings fbdev: omap2: omapfb: fix boolreturn.cocci warnings fb: amifb: fix build warnings when not builtin fbdev/core: Disable console-lock warnings when fb.lockless_register_fb is set console: Replace #if 0 with atomic var 'ignore_console_lock_warning' udlfb: use spin_lock_irq instead of spin_lock_irqsave udlfb: avoid prefetch udlfb: optimization - test the backing buffer udlfb: allow reallocating the framebuffer udlfb: set line_length in dlfb_ops_set_par udlfb: handle allocation failure udlfb: set optimal write delay udlfb: make a local copy of fb_ops udlfb: don't switch if we are switching to the same videomode ... 2018-08-18T18:04:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2018-08-18T18:04:51+00:00 urn:sha1:d5acba26bfa097a618be425522b1ec4269d3edaf Pull char/misc driver updates from Greg KH: "Here is the bit set of char/misc drivers for 4.19-rc1 There is a lot here, much more than normal, seems like everyone is writing new driver subsystems these days... Anyway, major things here are: - new FSI driver subsystem, yet-another-powerpc low-level hardware bus - gnss, finally an in-kernel GPS subsystem to try to tame all of the crazy out-of-tree drivers that have been floating around for years, combined with some really hacky userspace implementations. This is only for GNSS receivers, but you have to start somewhere, and this is great to see. Other than that, there are new slimbus drivers, new coresight drivers, new fpga drivers, and loads of DT bindings for all of these and existing drivers. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (255 commits) android: binder: Rate-limit debug and userspace triggered err msgs fsi: sbefifo: Bump max command length fsi: scom: Fix NULL dereference misc: mic: SCIF Fix scif_get_new_port() error handling misc: cxl: changed asterisk position genwqe: card_base: Use true and false for boolean values misc: eeprom: assignment outside the if statement uio: potential double frees if __uio_register_device() fails eeprom: idt_89hpesx: clean up an error pointer vs NULL inconsistency misc: ti-st: Fix memory leak in the error path of probe() android: binder: Show extra_buffers_size in trace firmware: vpd: Fix section enabled flag on vpd_section_destroy platform: goldfish: Retire pdev_bus goldfish: Use dedicated macros instead of manual bit shifting goldfish: Add missing includes to goldfish.h mux: adgs1408: new driver for Analog Devices ADGS1408/1409 mux dt-bindings: mux: add adi,adgs1408 Drivers: hv: vmbus: Cleanup synic memory free path Drivers: hv: vmbus: Remove use of slow_virt_to_phys() Drivers: hv: vmbus: Reset the channel callback in vmbus_onoffer_rescind() ... 2018-08-02T23:01:38+00:00 kbuild test robot fengguang.wu@intel.com 2018-07-25T17:57:00+00:00 urn:sha1:f46bdacdc06a2256187f98d7d063d1bd5c318b12 drivers/video/fbdev/omap2/omapfb/dss/dss_features.c:895:2-5: WARNING: Use BUG_ON instead of if condition followed by BUG. Please make sure the condition has no side effects (see conditional BUG_ON definition in include/asm-generic/bug.h) Use BUG_ON instead of a if condition followed by BUG. Semantic patch information: This makes an effort to find cases where BUG() follows an if condition on an expression and replaces the if condition and BUG() with a BUG_ON having the conditional expression of the if statement as argument. Generated by: scripts/coccinelle/misc/bugon.cocci Signed-off-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> 2018-08-02T23:01:05+00:00 kbuild test robot fengguang.wu@intel.com 2018-07-25T17:57:00+00:00 urn:sha1:73fc60aa6386ecb4201908be42241dcbd790d556 drivers/video/fbdev/omap2/omapfb/omapfb-main.c:290:9-10: WARNING: return of 0/1 in function 'cmp_var_to_colormode' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci Signed-off-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> 2018-08-02T23:00:39+00:00 kbuild test robot fengguang.wu@intel.com 2018-07-25T17:57:00+00:00 urn:sha1:ad1363c05a7d65ce6d4c5dca1fdec823b58d6e8b drivers/video/fbdev/omap2/omapfb/dss/core.c:141:2-26: WARNING: NULL check before some freeing functions is not needed. NULL check before some freeing functions is not needed. Based on checkpatch warning "kfree(NULL) is safe this check is probably not required" and kfreeaddr.cocci by Julia Lawall. Generated by: scripts/coccinelle/free/ifnullfree.cocci Signed-off-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> 2018-07-31T11:06:58+00:00 kbuild test robot fengguang.wu@intel.com 2018-07-31T11:06:58+00:00 urn:sha1:044e7ca20496b3c728c7ec87b778bf8cca8f012b drivers/video/fbdev/omap2/omapfb/dss/core.c:141:2-26: WARNING: NULL check before some freeing functions is not needed. NULL check before some freeing functions is not needed. Based on checkpatch warning "kfree(NULL) is safe this check is probably not required" and kfreeaddr.cocci by Julia Lawall. Generated by: scripts/coccinelle/free/ifnullfree.cocci Fixes: 7378f1149884 ("media: omap2: omapfb: allow building it with COMPILE_TEST") Signed-off-by: kbuild test robot <fengguang.wu@intel.com> Cc: Mauro Carvalho Chehab <m.chehab@samsung.com> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> 2018-07-31T11:06:58+00:00 kbuild test robot fengguang.wu@intel.com 2018-07-31T11:06:58+00:00 urn:sha1:6e7f3997bd546c3b36bc7f9ecee0d54dac22a2b3 drivers/video/fbdev/omap2/omapfb/dss/dss_features.c:895:2-5: WARNING: Use BUG_ON instead of if condition followed by BUG. Please make sure the condition has no side effects (see conditional BUG_ON definition in include/asm-generic/bug.h) Use BUG_ON instead of a if condition followed by BUG. Semantic patch information: This makes an effort to find cases where BUG() follows an if condition on an expression and replaces the if condition and BUG() with a BUG_ON having the conditional expression of the if statement as argument. Generated by: scripts/coccinelle/misc/bugon.cocci Fixes: 7378f1149884 ("media: omap2: omapfb: allow building it with COMPILE_TEST") Signed-off-by: kbuild test robot <fengguang.wu@intel.com> Cc: Mauro Carvalho Chehab <m.chehab@samsung.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>