Xi Wang a5cd335165 drm: integer overflow in drm_mode_dirtyfb_ioctl() ... There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if userspace passes in a large num_clips. The call to kmalloc would allocate a small buffer, and the call to fb->funcs->dirty may result in a memory corruption. Reported-by: Haogang Chen <haogangchen@gmail.com> Signed-off-by: Xi Wang <xi.wang@gmail.com> Cc: stable@kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>		2011-11-23 08:59:28 +00:00
..
i2c	drm: Import driver for the sil164 I2C TMDS transmitter.	2010-08-02 10:21:13 +10:00
ttm	Revert "drm/ttm: add a way to bo_wait for either the last read or last write"	2011-10-27 18:28:37 +02:00
Kbuild	drm: remove i830 driver	2011-02-07 12:14:18 +10:00
drm.h	drm/vblank: update recently added vbl interface to be more future proof.	2011-03-24 21:28:46 +10:00
drmP.h	drm: serialize access to list of debugfs files	2011-11-11 11:05:19 +00:00
drm_buffer.h	drm: Add generic multipart buffer.	2010-02-23 09:46:20 +10:00
drm_cache.h	drm/ttm: consolidate cache flushing code in one place.	2009-08-27 09:53:47 +10:00
drm_core.h	drm: Fix support for PCI domains	2010-08-10 08:20:20 +10:00
drm_crtc.h	drm: support routines for HDMI/DP ELD	2011-09-21 14:52:41 -07:00
drm_crtc_helper.h	drm, kdb, kms: Change mode_set_base_atomic() enter argument to be an enum	2010-10-19 14:13:33 +10:00
drm_dp_helper.h	drm/radeon/kms: properly set panel mode for eDP	2011-11-01 16:01:58 +00:00
drm_edid.h	drm: support routines for HDMI/DP ELD	2011-09-21 14:52:41 -07:00
drm_encoder_slave.h	drm/kms: no need to return void value (encoder)	2009-08-19 16:06:49 +10:00
drm_fb_helper.h	drm: Take lock around probes for drm_fb_helper_hotplug_event	2011-05-16 12:01:43 +10:00
drm_fixed.h	drm: move radeon_fixed.h to shared drm_fixed.h header	2010-05-18 18:21:33 +10:00
drm_global.h	drm: move ttm global code to core drm	2010-08-04 09:46:06 +10:00
drm_hashtab.h	drm: Remove unused members from struct drm_open_hash	2011-02-23 11:16:40 +10:00
drm_mem_util.h	drm/ttm: use drm calloc large and free large	2010-03-15 10:31:43 +10:00
drm_memory.h	includecheck fix: include/drm, drm_memory.h	2009-09-20 16:02:58 +05:30
drm_mm.h	drm: mm: fix debug output	2011-05-09 09:14:45 +10:00
drm_mode.h	drm: integer overflow in drm_mode_dirtyfb_ioctl()	2011-11-23 08:59:28 +00:00
drm_os_linux.h	drm/i915: add i915_lp_ring_sync helper	2009-11-05 14:47:07 -08:00
drm_pciids.h	drm/radeon: add some missing FireMV pci ids	2011-11-15 19:43:06 +00:00
drm_sarea.h	drm: move to kref per-master structures.	2008-12-29 17:47:22 +10:00
drm_sman.h	drm: reorganise drm tree to be more future proof.	2008-07-14 10:45:01 +10:00
drm_sysfs.h	drm: Enable drm drivers to add drm sysfs devices.	2009-08-19 16:08:51 +10:00
drm_usb.h	drm: add usb framework	2011-02-07 13:09:42 +10:00
exynos_drm.h	drm/exynos: added padding to be 64-bit align.	2011-11-11 12:01:49 +00:00
i810_drm.h	drm: reorganise drm tree to be more future proof.	2008-07-14 10:45:01 +10:00
i915_drm.h	drm/i915: Fix typo in DRM_I915_OVERLAY_PUT_IMAGE ioctl define	2011-07-22 13:36:44 -07:00
intel-gtt.h	drm/i915: ILK + VT-d workaround	2011-10-20 15:26:39 -07:00
mga_drm.h	Fix common misspellings	2011-03-31 11:26:23 -03:00
nouveau_drm.h	drm/nv50: support for compression	2011-02-25 06:46:07 +10:00
r128_drm.h	drm: reorganise drm tree to be more future proof.	2008-07-14 10:45:01 +10:00
radeon_drm.h	drm/radeon/kms: add a CS ioctl flag not to rewrite tiling flags in the CS	2011-11-20 07:53:13 +00:00
savage_drm.h	Fix common misspellings	2011-03-31 11:26:23 -03:00
sis_drm.h	drm: reorganise drm tree to be more future proof.	2008-07-14 10:45:01 +10:00
via_drm.h	drm: Add compatibility #ifdefs for *BSD	2009-12-04 08:59:28 +10:00
vmwgfx_drm.h	vmwgfx: Reinstate the update_layout ioctl	2011-11-02 08:30:31 +00:00