mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 01:32:21 +02:00
7f08fc10fa
info->var, a framebuffer's current mode, is expected to have a matching entry in info->modelist. var_to_display() relies on this and treats a failed fb_match_mode() as "This should not happen". fb_set_var() keeps it true by adding the mode to the list on every change, and do_register_framebuffer() does the same at registration. store_modes() replaces the modelist from userspace. fb_new_modelist() validates the new modes but does not check that info->var still has a match. It relies on fbcon_new_modelist() to re-point consoles, but that only handles consoles mapped to the framebuffer. With fbcon unbound there are none, so info->var is left describing a mode that is no longer in the list. A later console takeover runs var_to_display(), where fb_match_mode() returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode. Keep the current mode in the list in fb_new_modelist(), the same way fb_set_var() does. Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Ian Bridges <icb@fastmail.org> Signed-off-by: Helge Deller <deller@gmx.de> |
||
|---|---|---|
| .. | ||
| bitblit.c | ||
| cfbcopyarea.c | ||
| cfbfillrect.c | ||
| cfbimgblt.c | ||
| cfbmem.h | ||
| fb_backlight.c | ||
| fb_chrdev.c | ||
| fb_cmdline.c | ||
| fb_copyarea.h | ||
| fb_ddc.c | ||
| fb_defio.c | ||
| fb_draw.h | ||
| fb_fillrect.h | ||
| fb_imageblit.h | ||
| fb_info.c | ||
| fb_internal.h | ||
| fb_io_fops.c | ||
| fb_logo.c | ||
| fb_notify.c | ||
| fb_procfs.c | ||
| fb_sys_fops.c | ||
| fbcmap.c | ||
| fbcon_ccw.c | ||
| fbcon_cw.c | ||
| fbcon_rotate.c | ||
| fbcon_rotate.h | ||
| fbcon_ud.c | ||
| fbcon.c | ||
| fbcon.h | ||
| fbcvt.c | ||
| fbmem.c | ||
| fbmon.c | ||
| fbsysfs.c | ||
| Kconfig | ||
| Makefile | ||
| modedb.c | ||
| softcursor.c | ||
| svgalib.c | ||
| syscopyarea.c | ||
| sysfillrect.c | ||
| sysimgblt.c | ||
| sysmem.h | ||
| tileblit.c | ||