mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-24 06:50:12 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
d8421e09382cfe0bd2a044c8b0a822f64855dd4e
linux/drivers/video/fbdev
History
David Laight d8421e0938 fbdev: sm501fb: Fix buffer errors in OF binding code 
The code that gets the frame buffer mode from OF has 'use after free',
'buffer overrun' and memory leaks.

info->edid_data isn't free if the probe functions fail or if
pd->def_mode is set.

If both the CRT and PANEL are enabled info->edid_data is used after
being freed and is freed twice.

The string returned by of_get_property(np, "mode", &len) is just
written over either the static "640x480-16@60" or the module parameter
string without any regard for the length (which is most likely longer).

Use kstrump() for the OF mode and free everything before freeing 'info.

Fixes: 4295f9bf74 ("video, sm501: add OF binding to support SM501")
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-06-09 16:00:17 +02:00
..
aty
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
2026-06-07 18:25:42 +02:00
core
fbcon: correct CONFIG_FB_TILEBLITTING macro name in #endif comment
2026-06-09 16:00:11 +02:00
geode
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
i810
fbdev: i810: use appopriate log interface dev_info
2025-12-02 20:15:51 +01:00
kyro
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
matrox
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
mb862xx
fbdev: mb862xxfb: Use int type to store negative error codes
2025-09-30 23:21:34 +02:00
mmp
fbdev: mmpfb: Use strscpy() to copy device name
2026-06-09 16:00:11 +02:00
nvidia
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
2026-06-07 18:25:42 +02:00
omap
fbdev: omapfb: Add missing error check for clk_get()
2026-03-10 18:40:21 +01:00
omap2
fbdev: omap2: fix use-after-free in omapfb_mmap
2026-06-09 16:00:10 +02:00
riva
fbdev: rivafb: Use strscpy() to copy device name
2026-06-09 16:00:11 +02:00
savage
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
sis
fbdev: sisfb: Replace strlen() strcpy() pair with strscpy()
2026-06-09 16:00:11 +02:00
via
fbdev: viafb: check ioremap return value in viafb_lcd_get_mobile_state
2026-03-10 17:32:35 +01:00
68328fb.c
fbdev/68328fb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:54:16 +02:00
acornfb.c
fbdev/acornfb: Fix name of fb_ops initializer macro
2023-11-29 12:20:08 +01:00
acornfb.h
…
amifb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
arcfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
arkfb.c
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
asiliantfb.c
fbdev/asiliantfb: Use fbdev I/O helpers
2023-08-04 15:54:34 +02:00
atafb_iplan2p2.c
…
atafb_iplan2p4.c
…
atafb_iplan2p8.c
…
atafb_mfb.c
…
atafb_utils.h
…
atafb.c
fbdev/atafb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:54:38 +02:00
atafb.h
…
atmel_lcdfb.c
fbdev: atmel_lcdfb: Use strscpy() to copy device name
2026-06-09 16:00:11 +02:00
au1100fb.c
fbdev: au1100fb: Fix build on MIPS64
2026-03-05 17:35:12 +01:00
au1200fb.c
fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
2026-02-14 11:09:47 +01:00
au1200fb.h
…
broadsheetfb.c
fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
2026-06-07 18:25:42 +02:00
bt431.h
…
bt455.h
…
bw2.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
c2p_core.h
…
c2p_iplan2.c
fbdev/c2p: Include <linux/export.h>
2025-06-16 09:06:58 +02:00
c2p_planar.c
fbdev/c2p: Include <linux/export.h>
2025-06-16 09:06:58 +02:00
c2p.h
…
carminefb_regs.h
…
carminefb.c
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
2026-06-07 18:25:42 +02:00
carminefb.h
fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM
2025-05-31 10:24:01 +02:00
cg3.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
cg6.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
cg14.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
chipsfb.c
fbdev: chipsfb: add missing MODULE_DESCRIPTION() macro
2026-06-09 16:00:10 +02:00
cirrusfb.c
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
clps711x-fb.c
fbdev: clps711x-fb: Request memory region for MMIO
2026-04-22 16:46:40 +02:00
cobalt_lcdfb.c
fbdev: cobalt_lcdfb: Request memory region
2026-04-22 16:46:40 +02:00
controlfb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
controlfb.h
…
cyber2000fb.c
fbdev: cyber2000fb: Use strscpy() to copy device name
2026-06-09 16:00:11 +02:00
cyber2000fb.h
fbdev/cyber2000fb: Unexport symbols
2025-06-16 09:07:03 +02:00
dnfb.c
fbdev/dnfb: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:55:07 +02:00
edid.h
…
efifb.c
fbdev: efifb: fix memory leak in efifb_probe()
2026-06-07 18:25:42 +02:00
ep93xx-fb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
ffb.c
fbdev: ffb: fix corrupted video output on Sun FFB1
2026-02-14 11:09:47 +01:00
fm2fb.c
fbdev/fm2fb: Use fbdev I/O helpers
2023-08-04 15:54:35 +02:00
fsl-diu-fb.c
fbdev: fsl-diu-fb: add missing device_remove_file()
2025-03-26 22:39:21 +01:00
g364fb.c
fbdev/g364fb: fix build failure with mips
2023-09-02 08:18:40 -07:00
gbefb.c
fbdev: gbefb: fix to use physical address instead of dma address
2025-11-15 13:46:45 +01:00
goldfishfb.c
fbdev: goldfishfb: use devm_platform_ioremap_resource()
2026-03-09 13:06:48 +01:00
grvga.c
fbdev: grvga: Fix CLUT register address offset in comment
2026-06-09 16:00:10 +02:00
gxt4500.c
fbdev: gxt4500fb: Use dev_err instead of printk
2025-11-15 13:46:45 +01:00
hecubafb.c
fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
2026-06-07 18:25:42 +02:00
hitfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
hpfb.c
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
2024-08-30 18:42:38 +02:00
i740_reg.h
…
i740fb.c
fbdev: i740fb: fix potential memory leak in i740fb_probe()
2026-06-07 18:25:42 +02:00
imsttfb.c
fbdev: imsttfb: convert comma to semicolon
2024-09-02 13:54:26 +02:00
imxfb.c
fbdev: imxfb: Use of_device_get_match_data()
2026-06-07 18:25:42 +02:00
Kconfig
fbdev: remove Hercules monochrome ISA graphics adapter driver
2026-05-20 20:23:32 +02:00
leo.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
macfb.c
fbdev: macfb: Replace deprecated strcpy with strscpy
2026-03-09 13:06:48 +01:00
macmodes.c
fbdev: Include <linux/export.h>
2025-06-16 09:06:19 +02:00
macmodes.h
…
Makefile
fbdev: remove Hercules monochrome ISA graphics adapter driver
2026-05-20 20:23:32 +02:00
maxinefb.c
fbdev/maxinefb: Use fbdev I/O helpers
2023-08-04 15:54:36 +02:00
metronomefb.c
fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
2026-06-07 18:25:42 +02:00
n411.c
…
neofb.c
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
ocfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
offb.c
fbdev: offb: fix PCI device reference leak on probe failure
2026-04-22 15:45:38 +02:00
p9100.c
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
platinumfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
platinumfb.h
…
pm2fb.c
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
pm3fb.c
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
pmag-aa-fb.c
fbdev/pmag-aa-fb: Use fbdev I/O helpers
2023-08-04 15:54:37 +02:00
pmag-ba-fb.c
fbdev/pmag-ba-fb: Use fbdev I/O helpers
2023-08-04 15:54:37 +02:00
pmagb-b-fb.c
fbdev/pmagb-b-fb: Use fbdev I/O helpers
2023-08-04 15:54:37 +02:00
ps3fb.c
fbdev: Wrap user-invoked calls to fb_set_var() in helper
2026-06-09 16:00:10 +02:00
pvr2fb.c
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
pxa3xx-gcu.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
pxa3xx-gcu.h
…
pxa3xx-regs.h
…
pxa168fb.c
fbdev: pxa168fb: use devm_ioremap_resource() for MMIO
2026-06-09 16:00:10 +02:00
pxa168fb.h
…
pxafb.c
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
2025-12-02 19:49:10 +01:00
pxafb.h
…
q40fb.c
fbdev/q40fb: Use fbdev I/O helpers
2023-08-04 15:54:38 +02:00
s1d13xxxfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
s3c-fb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
s3fb.c
fbdev: s3fb: fix potential memory leak in s3_pci_probe()
2026-06-07 18:25:42 +02:00
sa1100fb.c
fbdev: Push pgprot_decrypted() into mmap implementations
2023-11-29 12:20:44 +01:00
sa1100fb.h
…
sbuslib.c
fbdev: Include <linux/export.h>
2025-06-16 09:06:19 +02:00
sbuslib.h
fbdev: Constify struct sbus_mmap_map
2024-10-15 10:07:32 +02:00
sh7760fb.c
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
2024-11-14 15:26:27 +01:00
sh_mobile_lcdcfb.c
fbdev: Wrap user-invoked calls to fb_set_var() in helper
2026-06-09 16:00:10 +02:00
sh_mobile_lcdcfb.h
…
simplefb.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
skeletonfb.c
fbdev: Remove FBINFO_DEFAULT from framebuffer_alloc()'ed structs
2023-07-24 16:50:38 +02:00
sm501fb.c
fbdev: sm501fb: Fix buffer errors in OF binding code
2026-06-09 16:00:17 +02:00
sm712.h
fbdev: sm712: Fix operator precedence in big_swap macro
2026-06-09 16:00:10 +02:00
sm712fb.c
fbdev/sm712fb: Use correct initializer macros for struct fb_ops
2023-11-29 12:20:10 +01:00
smscufx.c
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
ssd1307fb.c
fbdev: matroxfb/ssd1307fb: Use named initializers for struct i2c_device_id
2026-06-07 18:25:41 +02:00
sstfb.c
fbdev: sstfb: Make CONFIG_FB_DEVICE optional
2024-10-15 10:07:31 +02:00
stifb.c
fbdev: stifb: Fix crash in stifb_blank()
2024-01-23 09:13:24 +01:00
sunxvr500.c
fbdev/sunxvr500: Initialize fb_ops to fbdev I/O-memory helpers
2023-10-19 12:56:55 +02:00
sunxvr1000.c
BackMerge tag 'v6.5-rc7' into drm-next
2023-08-24 07:26:06 +10:00
sunxvr2500.c
fbdev: sunxvr2500: replace printk with device-aware logging functions
2026-06-09 16:00:10 +02:00
tcx.c
fbdev: tcx.c fix mem_map to correct smem_start offset
2025-12-02 19:44:05 +01:00
tdfxfb.c
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
2026-06-07 18:25:42 +02:00
tgafb.c
vt: remove superfluous CONFIG_HW_CONSOLE
2024-01-27 19:03:51 -08:00
tridentfb.c
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
2026-06-07 18:25:42 +02:00
udlfb.c
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
2026-05-04 10:35:55 +02:00
uvesafb.c
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
2026-06-07 18:25:42 +02:00
valkyriefb.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
valkyriefb.h
…
vesafb.c
fbdev: vesafb: fix memory leak in vesafb_probe()
2026-06-07 18:25:42 +02:00
vfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
vga16fb.c
sysfb: Pass sysfb_primary_display to devices
2025-12-16 14:12:44 +01:00
vt8500lcdfb.c
fbdev: vt8500lcdfb: fix missing dma_free_coherent()
2026-02-14 11:09:46 +01:00
vt8500lcdfb.h
…
vt8623fb.c
fbdev: Consistently define pci_device_ids using named initializers
2026-06-07 18:25:41 +02:00
wm8505fb_regs.h
…
wm8505fb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00
wmt_ge_rops.c
fbdev: wmt_ge_rops: use devm_platform_ioremap_resource()
2026-03-09 13:06:48 +01:00
wmt_ge_rops.h
…
xen-fbfront.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
xilinxfb.c
fbdev: Switch back to struct platform_driver::remove()
2024-10-08 21:47:18 +02:00