mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-23 23:37:42 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
ce3b24eb3ee8f82de851535f516bf21f83e82259
linux/drivers
History
Werner Kasselman ce3b24eb3e drm/radeon: fix integer overflow in radeon_align_pitch() 
radeon_align_pitch() has the same kind of overflow issue as the old
amdgpu helper: both the alignment round-up add and the final
'aligned * cpp' calculation can overflow signed int.

If that wraps, radeon_mode_dumb_create() can end up returning an
invalid pitch or creating a zero-sized dumb buffer.

Fix this by using check_add_overflow() for the alignment round-up and
check_mul_overflow() for the final pitch calculation, returning 0 on
overflow. Also reject zero pitch and size in
radeon_mode_dumb_create().

Found via AST-based call-graph analysis using sqry.

Fixes: ff72145bad ("drm: dumb scanout create/mmap for intel/radeon (v3)")
Signed-off-by: Werner Kasselman <werner@verivus.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-17 15:41:16 -04:00
..
accel
Merge tag 'drm-misc-next-fixes-2026-04-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
2026-04-10 11:15:22 +10:00
accessibility
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
acpi
Merge tag 'riscv-for-linus-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
2026-04-05 14:43:47 -07:00
amba
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
android
rust_binder: use AssertSync for BINDER_VM_OPS
2026-03-31 14:58:56 +02:00
ata
ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()
2026-03-20 09:59:30 +01:00
atm
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
auxdisplay
auxdisplay: line-display: fix NULL dereference in linedisp_release
2026-03-27 09:54:31 +01:00
base
mm: add gpu active/reclaim per-node stat counters (v2)
2026-04-08 06:52:47 +10:00
bcma
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
block
zram: do not slot_free() written-back slots
2026-03-21 17:36:33 -07:00
bluetooth
Bluetooth: hci_h4: Fix race during initialization
2026-04-01 16:45:47 -04:00
bus
driver core: platform: use generic driver_override infrastructure
2026-03-17 20:30:57 +01:00
cache
cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
2026-02-06 19:54:40 +00:00
cdrom
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
cdx
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
char
Merge tag 'for-linus-7.0-1' of https://github.com/cminyard/linux-ipmi
2026-02-26 14:34:21 -08:00
clk
driver core: platform: use generic driver_override infrastructure
2026-03-17 20:30:57 +01:00
clocksource
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
comedi
comedi: dt2815: add hardware detection to prevent crash
2026-04-02 14:40:27 +02:00
connector
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
counter
counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
2026-03-22 15:59:22 +09:00
cpufreq
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
2026-04-01 16:08:15 +02:00
cpuidle
sched: idle: Make skipping governor callbacks more consistent
2026-03-10 16:03:02 +01:00
crypto
Merge tag 'v7.0-p4' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2026-04-02 17:29:48 -07:00
cxl
cxl: Adjust the startup priority of cxl_pmem to be higher than that of cxl_acpi
2026-03-19 15:12:40 -07:00
dax
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dca
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
devfreq
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
dibs
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dio
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dma
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
2026-03-17 16:33:32 +05:30
dma-buf
dma-buf: fix htmldocs error for dma_buf_attach_revocable
2026-04-10 19:22:02 +05:30
dpll
Merge tag 'net-7.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2026-02-26 08:00:13 -08:00
edac
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
eisa
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
extcon
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
firewire
bonding: prevent potential infinite loop in bond_header_parse()
2026-03-16 19:29:45 -07:00
firmware
BackMerge tag 'v7.0-rc6' into drm-next
2026-03-31 07:51:02 +10:00
fpga
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
fsi
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
fwctl
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
gnss
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
gpib
gpib: fix use-after-free in IO ioctl handlers
2026-04-02 14:30:40 +02:00
gpio
gpio: shared: shorten the critical section in gpiochip_setup_shared()
2026-03-30 09:51:15 +02:00
gpu
drm/radeon: fix integer overflow in radeon_align_pitch()
2026-04-17 15:41:16 -04:00
greybus
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
hid
Merge tag 'hid-for-linus-2026031701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
2026-03-17 13:55:51 -07:00
hsi
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
hte
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
hv
mshv: Fix error handling in mshv_region_pin
2026-03-18 16:18:49 +00:00
hwmon
hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
2026-04-01 07:45:57 -07:00
hwspinlock
Merge tag 'soc-drivers-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2026-02-10 20:45:30 -08:00
hwtracing
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
i2c
i2c: designware: amdisp: Fix resume-probe race condition issue
2026-03-27 13:51:21 +01:00
i3c
i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
2026-03-11 22:50:29 +01:00
idle
intel_idle: Add C-states validation
2026-01-07 21:17:43 +01:00
iio
Merge tag 'iio-fixes-for-7.0c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus
2026-03-29 15:27:12 +02:00
infiniband
BackMerge tag 'v7.0-rc6' into drm-next
2026-03-31 07:51:02 +10:00
input
Merge tag 'input-for-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2026-04-04 08:24:32 -07:00
interconnect
interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()
2026-03-14 12:53:13 +02:00
iommu
Merge v7.0-rc7 into drm-next
2026-04-07 12:36:31 +02:00
ipack
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
irqchip
irqchip/riscv-aplic: Restrict genpd notifier to device tree only
2026-03-31 10:11:29 +02:00
isdn
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
leds
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
macintosh
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
mailbox
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
mcb
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
md
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
media
media: ccs: Avoid deadlock in ccs_init_state()
2026-03-26 13:14:07 +01:00
memory
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
memstick
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
message
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
mfd
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
misc
misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
2026-04-02 14:42:19 +02:00
mmc
mmc: sdhci: fix timing selection for 1-bit bus width
2026-03-16 16:08:54 +01:00
most
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
mtd
mtd: rawnand: pl353: make sure optimal timings are applied
2026-03-18 18:08:25 +01:00
mux
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
net
eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
2026-04-02 08:38:34 -07:00
nfc
NFC: pn533: bound the UART receive buffer
2026-03-31 11:04:30 +02:00
ntb
Merge tag 'kmalloc_obj-treewide-v7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
2026-02-21 11:02:58 -08:00
nubus
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
nvdimm
nvdimm/bus: Fix potential use after free in asynchronous initialization
2026-03-09 09:38:22 -05:00
nvme
Merge tag 'block-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2026-03-13 10:13:06 -07:00
nvmem
nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
2026-04-02 16:44:40 +02:00
of
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
opp
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
parisc
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
parport
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
pci
PCI/pwrctrl: Fix pci_pwrctrl_is_required() device node leak
2026-03-23 15:57:43 -05:00
pcmcia
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
peci
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
perf
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
phy
phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
2026-02-27 20:46:57 +05:30
pinctrl
pinctrl: sunxi: fix gpiochip_lock_as_irq() failure when pinmux is unknown
2026-03-23 14:23:09 +01:00
platform
platform/x86: ISST: Correct locked bit width
2026-03-24 12:31:10 +02:00
pmdomain
Merge tag 'pmdomain-v7.0-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
2026-03-20 09:46:15 -07:00
pnp
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
power
power: sequencing: pcie-m2: Fix device node reference leak in probe
2026-03-04 09:16:41 +01:00
powercap
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
pps
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ps3
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ptp
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
pwm
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
rapidio
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ras
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
regulator
regulator: pca9450: Correct probed name for PCA9452
2026-03-10 14:52:42 +00:00
remoteproc
remoteproc: imx_rproc: Fix unreachable platform prepare_ops
2026-03-05 10:18:23 -07:00
resctrl
arm_mpam: Force __iomem casts
2026-03-13 14:17:30 +00:00
reset
reset: rzg2l-usbphy-ctrl: Check pwrrdy is valid before using it
2026-02-23 17:03:28 +01:00
rpmsg
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
rtc
Merge tag 'rtc-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
2026-02-22 09:43:11 -08:00
s390
Merge tag 's390-7.0-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
2026-04-03 17:50:24 -07:00
sbus
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
scsi
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2026-03-27 19:58:22 -07:00
sh
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
siox
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
slimbus
driver core: platform: use generic driver_override infrastructure
2026-03-17 20:30:57 +01:00
soc
Merge tag 'v7.0-rockchip-drvfixes1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes
2026-03-17 09:35:40 +01:00
soundwire
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
spi
spi: cadence-qspi: Fix exec_mem_op error handling
2026-03-30 21:34:53 +01:00
spmi
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
ssb
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
staging
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
2026-02-24 10:01:20 -08:00
target
scsi: target: file: Use kzalloc_flex for aio_cmd
2026-03-19 22:07:39 -04:00
tc
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
tee
tee: shm: Remove refcounting of kernel pages
2026-03-03 09:03:04 +01:00
thermal
thermal: core: Fix thermal zone device registration error path
2026-04-02 11:37:35 +02:00
thunderbolt
thunderbolt: Fix property read in nhi_wake_supported()
2026-03-09 12:36:54 +01:00
tty
vt: resize saved unicode buffer on alt screen exit after resize
2026-03-30 17:39:44 +02:00
ufs
scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
2026-03-07 11:08:39 -05:00
uio
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
usb
Merge tag 'usb-serial-7.0-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
2026-04-02 13:28:22 +02:00
vdpa
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
vfio
BackMerge tag 'v7.0-rc6' into drm-next
2026-03-31 07:51:02 +10:00
vhost
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
video
Merge v7.0-rc3 into drm-next
2026-03-11 11:18:31 +01:00
virt
virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
2026-03-20 21:05:50 -07:00
virtio
dma-mapping: Clarify valid conditions for CPU cache line overlap
2026-03-20 11:33:24 +01:00
w1
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
watchdog
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
xen
xen/privcmd: unregister xenstore notifier on module exit
2026-03-26 08:57:51 +01:00
zorro
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
Kconfig
Merge tag 'staging-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
2025-12-06 18:52:00 -08:00
Makefile
phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY
2026-02-04 20:45:26 +05:30