github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fbdev fixes for 7.3-rc3:

Browse Source 
- vt core: prevent potential out of bounds read on font change
 - fbcon: prevent out of bounds read when logo bigger than screen
 - atafb: limit SuperBlitter operations to supported layouts only
 - vfb: fix driver removal cleanup sequence
 - ssd1307fb: fix possible NULL pointer dereference on missing match data
 - omapfb: Fix sparse warning in panel_enabled()
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaqUOqgAKCRD3ErUQojoP
 XzVJAQDnJRpRl9+xwTyUrE3iJk4SllnV6SF5td3AnkUZrjTbcAEA7zCEnH0jwfJ1
 NsU/EKj2+PleQ0+SGRBKHIoZPEC1bQU=
 =T0+q
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull fbdev fixes from Helge Deller:
 "Two patches for VT core code and fbcon prevent potential out-of-bounds
  reads on font or screen size changes, one fix limits the Superblitter
  in atafb to supported modes only, and some minor fixes for vfb,
  ssd1307fb and omapfb"

* tag 'fbdev-for-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: vfb: defer cleanup until the last reference
  fbdev: atafb: Restrict SuperBlitter to supported formats
  fbdev: ssd1307fb: fix NULL pointer dereference on missing match data
  fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo
  fbdev: omapfb: Fix __be32 sparse warning in panel_enabled()
  vt: hide cursor prior to font changes to avoid out-of-bound reads
This commit is contained in:
Linus Torvalds 2026-09-12 08:06:04 -07:00
commit 31a4327ffe
6 changed files with 32 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/tty/vt/vt.c
View File

@ -4986,8 +4986,8 @@ static int con_font_set(struct vc_data *vc, const struct console_font_op *op)
if (!vc->vc_sw->con_font_set)
return -ENOSYS;
if (vc_is_sel(vc))
clear_selection();
/* hide selection and cursor prior font changes */
hide_cursor(vc);
return vc->vc_sw->con_font_set(vc, &font, vpitch, op->flags);
}
@ -5011,8 +5011,9 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
if (!vc->vc_sw->con_font_default)
return -ENOSYS;
if (vc_is_sel(vc))
clear_selection();
/* hide selection and cursor prior font changes */
hide_cursor(vc);
int ret = vc->vc_sw->con_font_default(vc, &font, s);
if (ret)
return ret;

6
drivers/video/fbdev/atafb.c
View File

@ -3360,7 +3360,11 @@ static int __init atafb_probe(struct platform_device *pdev)
memset (screen_base, 0, external_len);
/* framebuffer in SV RAM: enable the SuperBlitter */
if (external_addr >= 0xa0000000) {
if (external_addr >= 0xa0000000 &&
((external_pmode == FB_TYPE_PACKED_PIXELS &&
external_depth == 8) ||
(external_pmode == -1 &&
(external_depth == 16 || external_depth == 32)))) {
svblit_regs = ioremap(SVBLIT_REGS_PHYS, 0x100);
if (svblit_regs) {
svblit_fw = svblit_rd(SVBLIT_VERSION) & 0x1ff;

7
drivers/video/fbdev/core/fbcon.c
View File

@ -660,6 +660,13 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
erase &= ~0x400;
logo_height = fb_prepare_logo(info, par->rotate);
logo_lines = DIV_ROUND_UP(logo_height, vc->vc_font.height);
logo_lines = min(logo_lines, rows);
logo_lines = min(logo_lines, new_rows - 1);
if (logo_lines <= 0) {
logo_lines = 0;
logo_shown = FBCON_LOGO_DONTSHOW;
return;
}
q = (unsigned short *) (vc->vc_origin +
vc->vc_size_row * rows);
step = logo_lines * cols;

5
drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c
View File

@ -210,12 +210,13 @@ static void set_display_state(struct panel_drv_data *ddata, int enabled)
static int panel_enabled(struct panel_drv_data *ddata)
{
__be32 disp_status_be;
u32 disp_status;
int enabled;
acx565akm_read(ddata, MIPID_CMD_READ_DISP_STATUS,
(u8 *)&disp_status, 4);
disp_status = __be32_to_cpu(disp_status);
(u8 *)&disp_status_be, 4);
disp_status = __be32_to_cpu(disp_status_be);
enabled = (disp_status & (1 << 17)) && (disp_status & (1 << 10));
dev_dbg(&ddata->spi->dev,
"LCD panel %senabled by bootloader (status 0x%04x)\n",

4
drivers/video/fbdev/ssd1307fb.c
View File

@ -665,6 +665,10 @@ static int ssd1307fb_probe(struct i2c_client *client)
spin_lock_init(&par->damage_lock);
par->device_info = device_get_match_data(dev);
if (!par->device_info) {
ret = -ENODEV;
goto fb_alloc_error;
}
par->reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
if (IS_ERR(par->reset)) {

11
drivers/video/fbdev/vfb.c
View File

@ -78,6 +78,13 @@ static int vfb_pan_display(struct fb_var_screeninfo *var,
static int vfb_mmap(struct fb_info *info,
struct vm_area_struct *vma);
static void vfb_destroy(struct fb_info *info)
{
vfree(info->screen_buffer);
fb_dealloc_cmap(&info->cmap);
framebuffer_release(info);
}
static const struct fb_ops vfb_ops = {
.owner = THIS_MODULE,
__FB_DEFAULT_SYSMEM_OPS_RDWR,
@ -87,6 +94,7 @@ static const struct fb_ops vfb_ops = {
.fb_pan_display = vfb_pan_display,
__FB_DEFAULT_SYSMEM_OPS_DRAW,
.fb_mmap = vfb_mmap,
.fb_destroy = vfb_destroy,
};
/*
@ -485,9 +493,6 @@ static void vfb_remove(struct platform_device *dev)
if (info) {
unregister_framebuffer(info);
vfree(videomemory);
fb_dealloc_cmap(&info->cmap);
framebuffer_release(info);
}
}