android_kernel_samsung_msm8976/drivers
Manfred Schlaegl 32f32907a8 fbdev: fbmem: fix memory access if logo is bigger than the screen
[ Upstream commit a5399db139cb3ad9b8502d8b1bd02da9ce0b9df0 ]

There is no clipping on the x or y axis for logos larger that the framebuffer
size. Therefore: a logo bigger than screen size leads to invalid memory access:

[    1.254664] Backtrace:
[    1.254728] [<c02714e0>] (cfb_imageblit) from [<c026184c>] (fb_show_logo+0x620/0x684)
[    1.254763]  r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4
[    1.254774]  r4:c6a3e800
[    1.254810] [<c026122c>] (fb_show_logo) from [<c026c1e4>] (fbcon_switch+0x3fc/0x46c)
[    1.254842]  r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800
[    1.254852]  r4:c6808c00
[    1.254889] [<c026bde8>] (fbcon_switch) from [<c029c8f8>] (redraw_screen+0xf0/0x1e8)
[    1.254918]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080
[    1.254928]  r4:c6808c00
[    1.254961] [<c029c808>] (redraw_screen) from [<c029d264>] (do_bind_con_driver+0x194/0x2e4)
[    1.254991]  r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0

So prevent displaying a logo bigger than screen size and avoid invalid
memory access.

Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-07-27 22:10:04 +02:00
..
accessibility
acpi
amba
android binder: Remove Samsung special not in any upstream code 2019-07-27 22:09:15 +02:00
ata
atm
auxdisplay
base PM / wakeup: Only update last time for active wakeup sources 2019-07-27 21:52:47 +02:00
battery
battery_v2
bcma
bif
block block/loop: Use global lock for ioctl() operation. 2019-07-27 21:53:37 +02:00
bluetooth bluetooth: Define proper kernel messages 2019-07-27 22:08:39 +02:00
bus
cdrom
char diag: Handle data ready notification properly 2019-07-27 22:08:48 +02:00
clk clk: qcom: mdss: initialise spread freq variable before usage 2019-07-27 21:51:05 +02:00
clocksource
connector
coresight
cpufreq cpufreq: interactive governor drops bits in time calculation 2019-07-27 21:50:42 +02:00
cpuidle lpm-levels: Remove kfree for memory allocated with devm_kzalloc 2019-07-27 22:08:40 +02:00
crypto msm: ice: check for crypto engine availability 2019-07-27 22:08:47 +02:00
dca
debug
debug_32
devfreq dev_freq: devfreq_spdm: add null terminator to prevent OOB access 2019-07-27 21:50:47 +02:00
dio
dma
edac
eisa
esoc
extcon
fingerprint
firewire
firmware
gpio soc: qcom: Remove smp2p test support 2019-07-27 22:08:44 +02:00
gpu drm: set FMODE_UNSIGNED_OFFSET for drm files 2019-07-27 21:52:11 +02:00
hid HID: hiddev: fix potential Spectre v1 2019-07-27 22:06:00 +02:00
hsi
hv
hwmon
hwspinlock
i2c i2c: dev: prevent adapter retries and timeout being set as minus value 2019-07-27 21:53:34 +02:00
ide
idle
iio iio:kfifo_buf: check for uint overflow 2019-07-27 21:52:28 +02:00
infiniband
input input: touchscreen: synaptics_dsx: Fix buffer overflow 2019-07-27 22:08:43 +02:00
iommu
ipack
irqchip
isdn
leds
lguest
macintosh
mailbox
md dm kcopyd: avoid softlockup in run_complete_job 2019-07-27 21:51:38 +02:00
media media: v4l2-ctrls.c/uvc: zero v4l2_event 2019-07-27 22:08:54 +02:00
memory
memstick
message
mfd
misc dsp: codecs: fix range check for audio buffer copying 2019-07-27 22:08:47 +02:00
mmc mmc: mmc: fix switch timeout issue caused by jiffies precision 2019-07-27 22:08:58 +02:00
motor
mtd
muic muic: Fix WRITE redefined compile error 2019-07-27 22:05:59 +02:00
net qcacld-2.0: wlan_hdd_restart_driver: no WCNSS, so call VOS_BUG(0) instead 2019-07-27 22:10:01 +02:00
nfc
ntb
nubus
of
oprofile
parisc
parport
pci
pcmcia
phy
pinctrl
platform msm: msm_bus: Fix error handling in msm_bus_device_init 2019-07-27 22:08:45 +02:00
pnp
power drivers: qcom: lpm-stats: Fix undefined access error 2019-07-27 21:50:48 +02:00
pps
ps3
ptp
pwm
rapidio
regulator regulator: core: Fix buffer overflow issue 2019-07-27 22:08:41 +02:00
remoteproc
reset
rpmsg
rtc
s390
sbus
scsi scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c 2019-07-27 22:10:03 +02:00
sensorhub
sensors
sfi
sh
slimbus
sn
soc qdsp6v2: apr: check for packet size to header size comparison 2019-07-27 22:08:48 +02:00
soundwire
spi
spmi
ssb
ssbi
staging ANDROID: Remove conflicting Samsung options for upstream changes 2019-07-27 22:09:50 +02:00
switch
target scsi: target: fix __transport_register_session locking 2019-07-27 21:51:38 +02:00
tc
thermal msm: thermal: validate userspace args to prevent buffer overflow. 2019-07-27 22:10:00 +02:00
tty
uio uio: Fix an Oops on load 2019-07-27 22:06:01 +02:00
usb usb: f_fs: set ep->driver_data on unbind 2019-07-27 22:09:30 +02:00
uwb
vfio
vhost
video fbdev: fbmem: fix memory access if logo is bigger than the screen 2019-07-27 22:10:04 +02:00
virt
virtio
vlynq
vme
w1
watchdog
xen
zorro
Kconfig
Makefile