linux-stable.git/drivers/video/console/bitblit.c, branch linux-4.4.y

fbcon: remove now unusued 'softback_lines' cursor() argument

2020-09-23T06:44:25+00:00

commit 06a0df4d1b8b13b551668e47b11fd7629033b7df upstream.

Since the softscroll code got removed, this argument is always zero and
makes no sense any more.

Tested-by: Yuan Ming 
Tested-by: Willy Tarreau 
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

2020-08-21T08:52:53+00:00

[ Upstream commit 033724d6864245a11f8e04c066002e6ad22b3fd0 ]

syzbot is reporting general protection fault in bitfill_aligned() [1]
caused by integer underflow in bit_clear_margins(). The cause of this
problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.

If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres
is going to shrink, vc->vc_{cols,rows} will not be updated. This allows
bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or
info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will
try to overrun the __iomem region and causes general protection fault.

Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to

  new_cols = (cols ? cols : vc->vc_cols);
  new_rows = (lines ? lines : vc->vc_rows);

exception. Since cols and lines are calculated as

  cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
  rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
  cols /= vc->vc_font.width;
  rows /= vc->vc_font.height;
  vc_resize(vc, cols, rows);

in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0
and var.yres < vc->vc_font.height makes rows = 0. This means that

  const int fd = open("/dev/fb0", O_ACCMODE);
  struct fb_var_screeninfo var = { };
  ioctl(fd, FBIOGET_VSCREENINFO, &var);
  var.xres = var.yres = 1;
  ioctl(fd, FBIOPUT_VSCREENINFO, &var);

easily reproduces integer underflow bug explained above.

Of course, callers of vc_resize() are not handling vc_do_resize() failure
is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore,
as a band-aid workaround, this patch checks integer underflow in
"struct fbcon_ops"->clear_margins call, assuming that
vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not
cause integer overflow.

[1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6

Reported-and-tested-by: syzbot 
Signed-off-by: Tetsuo Handa 
Acked-by: Daniel Vetter 
Cc: stable 
Link: https://lore.kernel.org/r/20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

framebuffer: fix border color

2014-09-30T10:39:16+00:00

The framebuffer code uses the current background color to fill the border
when switching consoles, however, this results in inconsistent behavior.
For example:
- start Midnigh Commander
- the border is black
- switch to another console and switch back
- the border is cyan
- type something into the command line in mc
- the border is cyan
- switch to another console and switch back
- the border is black
- press F9 to go to menu
- the border is black
- switch to another console and switch back
- the border is dark blue

When switching to a console with Midnight Commander, the border is random
color that was left selected by the slang subsystem.

This patch fixes this inconsistency by always using black as the
background color when switching consoles.

Signed-off-by: Mikulas Patocka 
Cc: stable@vger.kernel.org
Signed-off-by: Tomi Valkeinen

fbcon: Fix bit_putcs() call to kmalloc(s, GFP_KERNEL)

2012-08-23T12:29:32+00:00

Switch to kmalloc(,GFP_ATOMIC) in bit_putcs to fix below trace:

[    9.771812] BUG: sleeping function called from invalid context at /usr/src/linux-git/mm/slub.c:943
[    9.771814] in_atomic(): 1, irqs_disabled(): 1, pid: 1063, name: mount
[    9.771818] Pid: 1063, comm: mount Not tainted 3.5.0-jupiter-00003-g8d858b1-dirty #2
[    9.771819] Call Trace:
[    9.771838]  [] __might_sleep+0xcb/0xe0
[    9.771844]  [] __kmalloc+0xb4/0x1c0
[    9.771851]  [] ? queue_work+0x1a/0x30
[    9.771854]  [] ? queue_delayed_work+0xf/0x30
[    9.771862]  [] ? bit_putcs+0xf2/0x3e0
[    9.771865]  [] ? schedule_delayed_work+0x11/0x20
[    9.771868]  [] bit_putcs+0xf2/0x3e0
[    9.771875]  [] ? get_color.clone.14+0x28/0x100
[    9.771878]  [] fbcon_putcs+0x11f/0x130
[    9.771882]  [] ? bit_clear+0xe0/0xe0
[    9.771885]  [] fbcon_redraw.clone.21+0x11d/0x160
[    9.771889]  [] fbcon_scroll+0x79d/0xe10
[    9.771892]  [] ? get_color.clone.14+0x28/0x100
[    9.771897]  [] scrup+0x64/0xd0
[    9.771900]  [] lf+0x2b/0x60
[    9.771903]  [] vt_console_print+0x1d5/0x2f0
[    9.771907]  [] ? register_vt_notifier+0x20/0x20
[    9.771913]  [] call_console_drivers.clone.5+0xa5/0xc0
[    9.771916]  [] console_unlock+0x2fe/0x3c0
[    9.771920]  [] vprintk_emit+0x2e6/0x300
[    9.771924]  [] printk+0x38/0x3a
[    9.771931]  [] reiserfs_remount+0x2ae/0x3e0
[    9.771934]  [] ? reiserfs_fill_super+0xb00/0xb00
[    9.771939]  [] do_remount_sb+0xab/0x150
[    9.771943]  [] ? ns_capable+0x46/0x70
[    9.771948]  [] do_mount+0x20c/0x6b0
[    9.771955]  [] ? strndup_user+0x34/0x50
[    9.771958]  [] sys_mount+0x6c/0xa0
[    9.771964]  [] sysenter_do_call+0x12/0x26

According to comment in bit_putcs() that kammloc() call only happens
when fbcon is drawing to a monochrome framebuffer (which is my case with
hid-picolcd).

Signed-off-by: Bruno Prémont 
Signed-off-by: Florian Tobias Schandinat

fbcon: uninline four foo_update_attr() functions

2010-08-11T15:59:09+00:00

This patch uninlines four similar functions, foo_update_attr(), in four
fbcon-related files.

These functions contain loops, two of theam have _nested_ loops, and they
have more than one callsite each.  I think they should not be inlined.

Signed-off-by: Denys Vlasenko 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30T13:02:32+00:00

percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files.  percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.

percpu.h -> slab.h dependency is about to be removed.  Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability.  As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.

  http://userweb.kernel.org/~tj/misc/slabh-sweep.py

The script does the followings.

* Scan files for gfp and slab usages and update includes such that
  only the necessary includes are there.  ie. if only gfp is used,
  gfp.h, if slab is used, slab.h.

* When the script inserts a new include, it looks at the include
  blocks and try to put the new include such that its order conforms
  to its surrounding.  It's put in the include block which contains
  core kernel includes, in the same order that the rest are ordered -
  alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
  doesn't seem to be any matching order.

* If the script can't find a place to put a new include (mostly
  because the file doesn't have fitting include block), it prints out
  an error message indicating which .h file needs to be added to the
  file.

The conversion was done in the following steps.

1. The initial automatic conversion of all .c files updated slightly
   over 4000 files, deleting around 700 includes and adding ~480 gfp.h
   and ~3000 slab.h inclusions.  The script emitted errors for ~400
   files.

2. Each error was manually checked.  Some didn't need the inclusion,
   some needed manual addition while adding it to implementation .h or
   embedding .c file was more appropriate for others.  This step added
   inclusions to around 150 files.

3. The script was run again and the output was compared to the edits
   from #2 to make sure no file was left behind.

4. Several build tests were done and a couple of problems were fixed.
   e.g. lib/decompress_*.c used malloc/free() wrappers around slab
   APIs requiring slab.h to be added manually.

5. The script was run on all .h files but without automatically
   editing them as sprinkling gfp.h and slab.h inclusions around .h
   files could easily lead to inclusion dependency hell.  Most gfp.h
   inclusion directives were ignored as stuff from gfp.h was usually
   wildly available and often used in preprocessor macros.  Each
   slab.h inclusion directive was examined and added manually as
   necessary.

6. percpu.h was updated not to include slab.h.

7. Build test were done on the following configurations and failures
   were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my
   distributed build env didn't work with gcov compiles) and a few
   more options had to be turned off depending on archs to make things
   build (like ipr on powerpc/64 which failed due to missing writeq).

   * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
   * powerpc and powerpc64 SMP allmodconfig
   * sparc and sparc64 SMP allmodconfig
   * ia64 SMP allmodconfig
   * s390 SMP allmodconfig
   * alpha SMP allmodconfig
   * um on x86_64 SMP allmodconfig

8. percpu.h modifications were reverted so that it could be applied as
   a separate patch and serve as bisection point.

Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.

Signed-off-by: Tejun Heo 
Guess-its-ok-by: Christoph Lameter 
Cc: Ingo Molnar 
Cc: Lee Schermerhorn

video: console, use DIV_ROUND_UP

2009-09-23T14:39:56+00:00

Use DIV_ROUND_UP explicitly instead of manual shifts and adds.  It makes
the code more readable and consistent (sometimes there were shifts,
sometimes divs).

There is no change on the assembly level (compilers should do the right
job).

Signed-off-by: Jiri Slaby 
Cc: Sergey Senozhatsky 
Cc: Andi Kleen 
Cc: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbcon: fix color generation for monochrome framebuffer

2008-02-06T18:41:18+00:00

The current attr_fgcol_ec / attr_bgcol_ec macros do a simple shift of bits
to get the color from vc_video_erase_char.  For a monochrome display
however the attribute does not contain any color, only attribute bits.
Furthermore the reverse bit is lost because it is shifted out, the
resulting color is always 0.

This can bee seen on a monochrome console either directly or by setting it
to inverse mode via "setterm -inversescreen on" .  Text is written with
correct color, fb_fillrects from a bit_clear / bit_clear_margins will get
wrong colors.

Signed-off-by: Thomas Pfaff 
Cc: "Antonino A. Daplas" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Remove obsolete #include

2006-06-30T17:25:36+00:00

Signed-off-by: Jörn Engel 
Signed-off-by: Adrian Bunk

[PATCH] fbcon: Sanitize fbcon

2006-01-10T16:01:42+00:00

Do not pass the structure display since fbcon is already keeping the pointer
to the current display.

Signed-off-by: Antonino Daplas 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds