fbdev: add palette register check to several drivers

Add check if palette register number is in correct range for few drivers
which miss it.  The regno value comes indirectly from user space.

Two drivers has converted check from BUG_ON() macro to just return an
error (non-zero value).

Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/video/atafb.c b/drivers/video/atafb.c
index b7687c55fe16b6d04efed50a5059dd1b100672ec..2051c9dc813bf9fc1a1cb27c29f144322f039e91 100644 (file)
--- a/drivers/video/atafb.c
+++ b/drivers/video/atafb.c
@@ -2245,6 +2245,9 @@ static int ext_setcolreg(unsigned int regno, unsigned int red,
        if (regno > 255)
                return 1;
 
+       if (regno > 255)
+               return 1;
+
        switch (external_card_type) {
        case IS_VGA:
                OUTB(0x3c8, regno);

diff --git a/drivers/video/ep93xx-fb.c b/drivers/video/ep93xx-fb.c
index bd9d46f95291435622551df82f3a863ab3f1c78e..27aab4a0619851b0d38301f2d3ecba0a761c24db 100644 (file)
--- a/drivers/video/ep93xx-fb.c
+++ b/drivers/video/ep93xx-fb.c
@@ -358,6 +358,8 @@ static int ep93xxfb_setcolreg(unsigned int regno, unsigned int red,
 
        switch (info->fix.visual) {
        case FB_VISUAL_PSEUDOCOLOR:
+               if (regno > 255)
+                       return 1;
                rgb = ((red & 0xff00) << 8) | (green & 0xff00) |
                        ((blue & 0xff00) >> 8);
 

diff --git a/drivers/video/maxinefb.c b/drivers/video/maxinefb.c
index 5e91c2b30af9113edc6fc37d2b22752f59caae62..7854c7a37dc58430e3751ebedbce9c6286cf6280 100644 (file)
--- a/drivers/video/maxinefb.c
+++ b/drivers/video/maxinefb.c
@@ -92,6 +92,9 @@ static int maxinefb_setcolreg(unsigned regno, unsigned red, unsigned green,
        /* value to be written into the palette reg. */
        unsigned long hw_colorvalue = 0;
 
+       if (regno > 255)
+               return 1;
+
        red   >>= 8;    /* The cmap fields are 16 bits    */
        green >>= 8;    /* wide, but the harware colormap */
        blue  >>= 8;    /* registers are only 8 bits wide */

diff --git a/drivers/video/pmag-ba-fb.c b/drivers/video/pmag-ba-fb.c
index 0573ec685a57ebc73156a2d4dcab8f3e177f9ae8..0f361b6100d2b6dc671c1ff1297718e2e47735fc 100644 (file)
--- a/drivers/video/pmag-ba-fb.c
+++ b/drivers/video/pmag-ba-fb.c
@@ -98,7 +98,8 @@ static int pmagbafb_setcolreg(unsigned int regno, unsigned int red,
 {
        struct pmagbafb_par *par = info->par;
 
-       BUG_ON(regno >= info->cmap.len);
+       if (regno >= info->cmap.len)
+               return 1;
 
        red   >>= 8;    /* The cmap fields are 16 bits    */
        green >>= 8;    /* wide, but the hardware colormap */

diff --git a/drivers/video/pmagb-b-fb.c b/drivers/video/pmagb-b-fb.c
index 98748723af9f88cf5e433de72889f69e6b0f7ef0..2de0806421b49b450c5a9c73b12aceec4719f3cd 100644 (file)
--- a/drivers/video/pmagb-b-fb.c
+++ b/drivers/video/pmagb-b-fb.c
@@ -102,7 +102,8 @@ static int pmagbbfb_setcolreg(unsigned int regno, unsigned int red,
 {
        struct pmagbbfb_par *par = info->par;
 
-       BUG_ON(regno >= info->cmap.len);
+       if (regno >= info->cmap.len)
+               return 1;
 
        red   >>= 8;    /* The cmap fields are 16 bits    */
        green >>= 8;    /* wide, but the hardware colormap */