linux_dsm_epyc7002/drivers/gpu/drm
Dan Carpenter 09c4b49457 drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
This doesn't affect runtime because in the current code "idx" is always
valid.

First, we read from "vgdev->capsets[idx].max_size" before checking
whether "idx" is within bounds.  And secondly the bounds check is off by
one so we could end up reading one element beyond the end of the
vgdev->capsets[] array.

Fixes: 62fb7a5e10 ("virtio-gpu: add 3d/virgl support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2018-08-30 09:41:03 +02:00
..
amd Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
arc drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
arm Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
armada drm/armada: remove obsolete fb unreferencing kfifo and workqueue 2018-07-30 11:53:06 +01:00
ast drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
atmel-hlcdc drm/atmel-hlcdc: support bus-width (12/16/18/24) in endpoint nodes 2018-08-27 21:22:52 +02:00
bochs drm/bochs: Replace ttm_bo_unref with ttm_bo_put 2018-08-30 09:41:00 +02:00
bridge drm/bridge: ti-sn65dsi86: Add mystery delay to enable() 2018-08-27 10:57:20 -04:00
cirrus drm/cirrus: Replace ttm_bo_unref with ttm_bo_put 2018-08-30 09:41:00 +02:00
etnaviv Merge branch 'etnaviv/next' of https://git.pengutronix.de/git/lst/linux into drm-next 2018-08-08 06:07:30 +10:00
exynos drm/exynos/mixer: Remove unused local variable priv 2018-07-24 16:28:53 +09:00
fsl-dcu drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
gma500 Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
hisilicon drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
i2c VLA leftovers pull summary: 2018-08-17 10:40:09 -07:00
i810 drm/i810: off by one in i810_dma_vertex() 2018-07-03 15:00:42 +02:00
i915 Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
imx Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
lib
mediatek Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
meson drm/meson: Make DMT timings parameters and pixel clock generic 2018-07-16 11:14:59 +02:00
mga
mgag200 drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
msm Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
mxsfb
nouveau Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
omapdrm drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
panel drm/panel: simple: tv123wam: Add unprepare delay 2018-08-14 13:42:37 -04:00
pl111 drm/pl111: Use 64-bit arithmetic instead of 32-bit 2018-07-17 11:25:18 -07:00
qxl drm/qxl: Replace ttm_bo_unref with ttm_bo_put 2018-08-30 09:41:01 +02:00
r128
radeon mm, oom: distinguish blockable mode for mmu notifiers 2018-08-22 10:52:44 -07:00
rcar-du drm/crc: Cleanup crtc_crc_open function 2018-08-22 09:47:58 -07:00
rockchip drm/rockchip: vop: fix some register define error for px30 2018-08-29 14:01:23 +02:00
savage drm/savage: off by one in savage_bci_cmdbuf() 2018-07-04 14:27:01 +02:00
scheduler drm/scheduler: fix param documentation 2018-08-09 11:57:39 -05:00
selftests drm-misc-next for 4.19: 2018-06-22 12:58:08 +10:00
shmobile drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
sis
sti drm/sti: do not remove the drm_bridge that was never added 2018-08-07 15:33:00 +02:00
stm drm/stm: Replace drm_dev_unref with drm_dev_put 2018-07-13 10:11:02 +02:00
sun4i Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
tdfx
tegra drm pull for 4.19-rc1 2018-08-15 17:39:07 -07:00
tilcdc drm-misc-next for 4.19: 2018-07-20 10:46:49 +10:00
tinydrm drm/tinydrm: Replace drm_dev_unref with drm_dev_put 2018-08-07 17:09:15 +02:00
ttm drm/ttm: clean up non-x86 definitions on ttm_tt 2018-08-01 17:23:56 -05:00
tve200
udl Merge branch 'drm-udl-next' of git://people.freedesktop.org/~airlied/linux into drm-next 2018-07-31 08:24:33 +10:00
v3d drm/scheduler: modify API to avoid redundancy 2018-07-25 15:06:19 -05:00
vc4 Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
vgem drm/vgem: Remove unecessary dma_fence_ops 2018-08-17 11:22:58 +02:00
via treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
virtio drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() 2018-08-30 09:41:03 +02:00
vkms Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
vmwgfx Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
xen drm: Replace NULL with error value in drm_prime_pages_to_sg 2018-07-23 11:47:35 +03:00
zte drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
ati_pcigart.c
drm_agpsupport.c
drm_atomic_helper.c Merge drm/drm-next into drm-misc-next 2018-08-27 10:00:03 -04:00
drm_atomic.c drm: Add per-plane pixel blend mode property 2018-08-24 17:31:37 +01:00
drm_auth.c
drm_blend.c drm: Add per-plane pixel blend mode property 2018-08-24 17:31:37 +01:00
drm_bridge.c
drm_bufs.c
drm_cache.c
drm_client.c drm/client: Fix double free in error path 2018-07-13 12:07:46 +02:00
drm_color_mgmt.c
drm_connector.c drm/connector: Fix typo in drm_connector_list_iter_next() 2018-07-16 13:18:09 -04:00
drm_context.c drm: re-enable error handling 2018-07-16 10:01:19 -04:00
drm_crtc_helper_internal.h
drm_crtc_helper.c
drm_crtc_internal.h drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_crtc.c drm: Skip __drm_mode_set_config_internal() on atomic drivers 2018-07-13 17:58:19 +03:00
drm_debugfs_crc.c Revert "drm: crc: Wait for a frame before returning from open()" 2018-08-22 09:50:16 -07:00
drm_debugfs.c drm: drop _mode_ from update_edit_property() 2018-07-13 18:40:27 +02:00
drm_dma.c
drm_dp_aux_dev.c
drm_dp_cec.c drm_dp_cec.c: fix formatting typo: %pdH -> %phD 2018-07-28 15:50:40 -03:00
drm_dp_dual_mode_helper.c
drm_dp_helper.c drm/dp: add missing ')' to I2C nack debug message 2018-08-01 10:00:15 -07:00
drm_dp_mst_topology.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_drv.c drm/dp_helper: Add DP aux channel tracing 2018-07-16 11:47:53 -04:00
drm_dumb_buffers.c drm-misc-next for 4.19: 2018-06-28 13:29:07 +10:00
drm_edid_load.c
drm_edid.c drm/edid: Add 6 bpc quirk for SDC panel in Lenovo B50-80 2018-08-23 10:25:39 +02:00
drm_encoder_slave.c
drm_encoder.c
drm_fb_cma_helper.c drm: Use horizontal and vertical chroma subsampling factor while calculating offsets in the physical address of framebuffer 2018-08-20 14:13:43 +01:00
drm_fb_helper.c drm/fb-helper: Finish the generic fbdev emulation 2018-07-10 14:54:09 +02:00
drm_file.c drm: Begin an API for in-kernel clients 2018-07-10 14:51:37 +02:00
drm_flip_work.c
drm_fourcc.c drm/fourcc: Add is_yuv field to drm_format_info to denote if the format is yuv 2018-07-18 16:56:45 +01:00
drm_framebuffer.c drm: Add drm_plane_mask() 2018-07-02 18:45:55 +03:00
drm_gem_cma_helper.c drm: Replace NULL with error value in drm_prime_pages_to_sg 2018-07-23 11:47:35 +03:00
drm_gem_framebuffer_helper.c drm/gem-fb-helper: Always do implicit sync 2018-06-20 14:43:13 +02:00
drm_gem.c drm/i915: Prevent writing into a read-only object via a GGTT mmap 2018-07-13 16:14:04 +01:00
drm_global.c drm: add SPDX identifier and clarify license 2018-06-29 15:28:47 -05:00
drm_hashtab.c treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
drm_info.c
drm_internal.h drm: provide management functions for drm_file 2018-06-25 16:17:03 +02:00
drm_ioc32.c
drm_ioctl.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_irq.c
drm_kms_helper_common.c
drm_lease.c turn filp_clone_open() into inline wrapper for dentry_open() 2018-07-10 23:29:03 -04:00
drm_legacy.h
drm_lock.c
drm_memory.c treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
drm_mipi_dsi.c drm: Add support for pps and compression mode command packet 2018-07-25 07:51:05 -04:00
drm_mm.c drm/mm: Add a search-by-address variant to only inspect a single hole 2018-05-24 15:04:30 +01:00
drm_mode_config.c drm: writeback: Add client capability for exposing writeback connectors 2018-06-20 15:30:20 +01:00
drm_mode_object.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_modes.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_modeset_helper.c
drm_modeset_lock.c drm: Change deadlock-avoidance algorithm for the modeset locks. 2018-07-03 09:46:05 +02:00
drm_of.c drm/doc: Include drm_of.c helpers 2018-07-13 18:40:28 +02:00
drm_panel_orientation_quirks.c
drm_panel.c drm/panel: Fix sphinx warning 2018-08-16 11:30:02 -04:00
drm_pci.c drm: drop drm_pcie_get_speed_cap_mask and drm_pcie_get_max_link_width 2018-07-05 16:40:00 -05:00
drm_plane_helper.c drm: add missing ctx argument to plane transitional helpers 2018-07-03 09:30:19 +02:00
drm_plane.c drm: Introduce __setplane_atomic() 2018-07-13 17:58:19 +03:00
drm_prime.c dma-buf: remove kmap_atomic interface 2018-06-20 15:59:34 +02:00
drm_print.c drm: Add puts callback for the coredump printer 2018-07-30 08:49:41 -04:00
drm_probe_helper.c drm: drop _mode_ from remaining connector functions 2018-07-13 18:40:27 +02:00
drm_property.c drm: Use kvzalloc for allocating blob property memory 2018-07-02 11:05:21 -05:00
drm_rect.c
drm_scatter.c
drm_scdc_helper.c
drm_simple_kms_helper.c drm: drop _mode_ from drm_mode_connector_attach_encoder 2018-07-13 18:40:27 +02:00
drm_syncobj.c drm/syncobj: Drop add/remove_callback from driver interface 2018-08-22 20:49:33 +02:00
drm_sysfs.c
drm_trace_points.c
drm_trace.h
drm_vblank.c drm/doc: clarify how to acquire required vblank event reference 2018-08-08 10:25:39 +02:00
drm_vm.c gpu: drm: drm_vm: Adding new typedef vm_fault_t 2018-05-29 08:58:46 +02:00
drm_vma_manager.c drm: add SPDX idenitifier and clarify license 2018-06-29 15:28:47 -05:00
drm_writeback.c drm: writeback: Fix doc that says connector should be disconnected 2018-07-16 16:35:27 +01:00
Kconfig drm: add support for DisplayPort CEC-Tunneling-over-AUX 2018-07-13 17:58:19 +03:00
Makefile drm: add support for DisplayPort CEC-Tunneling-over-AUX 2018-07-13 17:58:19 +03:00