Kees Cook 2dc705a993 fbdev: color map copying bounds checking ... Copying color maps to userspace doesn't check the value of to->start, which will cause kernel heap buffer OOB read due to signedness wraps. CVE-2016-8405 Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Kees Cook <keescook@chromium.org> Reported-by: Peter Pi (@heisecode) of Trend Micro Cc: Min Chong <mchong@google.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2017-01-24 16:26:14 -08:00
..
cfbcopyarea.c
cfbfillrect.c
cfbimgblt.c
fb_cmdline.c
fb_ddc.c
fb_defio.c	fbdev: fb_defio: Export fb_deferred_io_mmap	2016-05-02 16:24:49 +02:00
fb_draw.h
fb_notify.c
fb_sys_fops.c
fbcmap.c	fbdev: color map copying bounds checking	2017-01-24 16:26:14 -08:00
fbcvt.c
fbmem.c	fbdev: fbmem: implement error handling in fbmem_init()	2016-05-10 11:58:29 +03:00
fbmon.c	fbmon: remove unused function argument	2016-07-26 16:19:19 -07:00
fbsysfs.c
Makefile
modedb.c
svgalib.c
syscopyarea.c
sysfillrect.c
sysimgblt.c