<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/video/console, branch linux-2.6.32.y</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>fbcon: Bugfix soft cursor detection in Tile Blitting</title>
<updated>2011-03-27T18:30:39+00:00</updated>
<author>
<name>Henry Nestler</name>
<email>henry.nestler@gmail.com</email>
</author>
<published>2011-02-20T20:50:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=34d39c53e6857e752a1fe1b14449b11fef3e64cf'/>
<id>34d39c53e6857e752a1fe1b14449b11fef3e64cf</id>
<content type='text'>
commit d6244bc0ed0c52a795e6f4dcab3886daf3e74fac upstream.

Use mask 0x10 for "soft cursor" detection on in function tile_cursor.
(Tile Blitting Operation in framebuffer console).

The old mask 0x01 for vc_cursor_type detects CUR_NONE, CUR_LOWER_THIRD
and every second mode value as "software cursor". This hides the cursor
for these modes (cursor.mode = 0). But, only CUR_NONE or "software cursor"
should hide the cursor.
See also 0x10 in functions add_softcursor, bit_cursor and cw_cursor.

Signed-off-by: Henry Nestler &lt;henry.nestler@gmail.com&gt;
Signed-off-by: Paul Mundt &lt;lethal@linux-sh.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d6244bc0ed0c52a795e6f4dcab3886daf3e74fac upstream.

Use mask 0x10 for "soft cursor" detection on in function tile_cursor.
(Tile Blitting Operation in framebuffer console).

The old mask 0x01 for vc_cursor_type detects CUR_NONE, CUR_LOWER_THIRD
and every second mode value as "software cursor". This hides the cursor
for these modes (cursor.mode = 0). But, only CUR_NONE or "software cursor"
should hide the cursor.
See also 0x10 in functions add_softcursor, bit_cursor and cw_cursor.

Signed-off-by: Henry Nestler &lt;henry.nestler@gmail.com&gt;
Signed-off-by: Paul Mundt &lt;lethal@linux-sh.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>fb: remove fb_save_state() and fb_restore_state operations</title>
<updated>2009-11-12T15:25:56+00:00</updated>
<author>
<name>Krzysztof Helt</name>
<email>krzysztof.h1@wp.pl</email>
</author>
<published>2009-11-11T22:26:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f5c15d0b37ab1cd3969b8ce7828ab41c79f36f77'/>
<id>f5c15d0b37ab1cd3969b8ce7828ab41c79f36f77</id>
<content type='text'>
Remove fb_save_state() and fb_restore_state operations from frame buffer layer.
They are used only in two drivers:
1. savagefb  - and cause bug #11248
2. uvesafb

Usage of these operations is misunderstood in both drivers so kill these
operations, fix the bug #11248 and avoid confusion in the future.

Tested on Savage 3D/MV card and the patch fixes the bug #11248.

The frame buffer layer uses these funtions during switch between graphics
and text mode of the console, but these drivers saves state before
switching of the frame buffer (in the fb_open) and after releasing it (in
the fb_release).  This defeats the purpose of these operations.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11248

Signed-off-by: Krzysztof Helt &lt;krzysztof.h1@wp.pl&gt;
Reported-by: Jochen Hein &lt;jochen@jochen.org&gt;
Tested-by: Jochen Hein &lt;jochen@jochen.org&gt;
Cc: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Cc: Michal Januszewski &lt;spock@gentoo.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Remove fb_save_state() and fb_restore_state operations from frame buffer layer.
They are used only in two drivers:
1. savagefb  - and cause bug #11248
2. uvesafb

Usage of these operations is misunderstood in both drivers so kill these
operations, fix the bug #11248 and avoid confusion in the future.

Tested on Savage 3D/MV card and the patch fixes the bug #11248.

The frame buffer layer uses these funtions during switch between graphics
and text mode of the console, but these drivers saves state before
switching of the frame buffer (in the fb_open) and after releasing it (in
the fb_release).  This defeats the purpose of these operations.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11248

Signed-off-by: Krzysztof Helt &lt;krzysztof.h1@wp.pl&gt;
Reported-by: Jochen Hein &lt;jochen@jochen.org&gt;
Tested-by: Jochen Hein &lt;jochen@jochen.org&gt;
Cc: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Cc: Michal Januszewski &lt;spock@gentoo.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>vgacon: prevent vgacon_deinit from touching the hardware for inactive consoles.</title>
<updated>2009-09-23T14:39:57+00:00</updated>
<author>
<name>Francisco Jerez</name>
<email>currojerez@riseup.net</email>
</author>
<published>2009-09-22T23:47:53+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f0c7d2b72ad1a694c0c886a14cc708841181e9bd'/>
<id>f0c7d2b72ad1a694c0c886a14cc708841181e9bd</id>
<content type='text'>
fbcon makes the (reasonable) assumption that it only needs to program the
hardware once, when fbcon_init() is called for the foreground console.

This doesn't always play well with vgacon because vgacon_deinit() is only
doing its job when the last console it owns is closed (when switching from
vgacon to fbcon, that's usually *after* fbcon_init() has set the new
mode).

Depending on the hardware this can cause the wrong framebuffer location to
be scanned out (e.g.  reproduced on nv05 with the nouveau framebuffer
driver).

Signed-off-by: Francisco Jerez &lt;currojerez@riseup.net&gt;
Cc: "H. Peter Anvin" &lt;hpa@zytor.com&gt;
Cc: Alan Cox &lt;alan@lxorguk.ukuu.org.uk&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
fbcon makes the (reasonable) assumption that it only needs to program the
hardware once, when fbcon_init() is called for the foreground console.

This doesn't always play well with vgacon because vgacon_deinit() is only
doing its job when the last console it owns is closed (when switching from
vgacon to fbcon, that's usually *after* fbcon_init() has set the new
mode).

Depending on the hardware this can cause the wrong framebuffer location to
be scanned out (e.g.  reproduced on nv05 with the nouveau framebuffer
driver).

Signed-off-by: Francisco Jerez &lt;currojerez@riseup.net&gt;
Cc: "H. Peter Anvin" &lt;hpa@zytor.com&gt;
Cc: Alan Cox &lt;alan@lxorguk.ukuu.org.uk&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fbcon: only unbind from console if successfully registered</title>
<updated>2009-09-23T14:39:57+00:00</updated>
<author>
<name>Ian Armstrong</name>
<email>ian@iarmst.demon.co.uk</email>
</author>
<published>2009-09-22T23:47:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=2ddce3fd0acbdc1be684fb5f919ae3d2e9518aac'/>
<id>2ddce3fd0acbdc1be684fb5f919ae3d2e9518aac</id>
<content type='text'>
Attempting to unload a framebuffer module calls unregister_framebuffer()
which in turn gets fbcon to release it.  If fbcon has no framebuffers
linked to a console, it will also unbind itself from the console driver.
However, if fbcon never registered itself as a console driver, the unbind
will fail causing the framebuffer device entry to persist.  In most cases
this failure will result in an oops when attempting to access the now
non-existent device.

This patch ensures that the fbcon unbind request will succeed even if a
bind was never done.  It tracks if a successful bind ever occurred &amp; will
only attempt to unbind if needed.  If there never was a bind, it simply
returns with no error.

Signed-off-by: Ian Armstrong &lt;ian@iarmst.demon.co.uk&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Cc: &lt;stable@kernel.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Attempting to unload a framebuffer module calls unregister_framebuffer()
which in turn gets fbcon to release it.  If fbcon has no framebuffers
linked to a console, it will also unbind itself from the console driver.
However, if fbcon never registered itself as a console driver, the unbind
will fail causing the framebuffer device entry to persist.  In most cases
this failure will result in an oops when attempting to access the now
non-existent device.

This patch ensures that the fbcon unbind request will succeed even if a
bind was never done.  It tracks if a successful bind ever occurred &amp; will
only attempt to unbind if needed.  If there never was a bind, it simply
returns with no error.

Signed-off-by: Ian Armstrong &lt;ian@iarmst.demon.co.uk&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Cc: &lt;stable@kernel.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fb: do not ignore fb_set_par errors</title>
<updated>2009-09-23T14:39:56+00:00</updated>
<author>
<name>Florian Tobias Schandinat</name>
<email>FlorianSchandinat@gmx.de</email>
</author>
<published>2009-09-22T23:47:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=0fcf6ada2b8eb42d132c0846384f1299889609e3'/>
<id>0fcf6ada2b8eb42d132c0846384f1299889609e3</id>
<content type='text'>
At the moment about half of the framebuffer drivers can return an error
code in fb_set_par. Until now it would be silently ignored by fbmem.c
and fbcon.c. This patch fixes fbmem.c to return the error code and
restore var on error.

But it is not clear in which video mode the device is when fb_set_par
fails.  It would be good and reasonable if it were in the old state but
there is no guarantee that this is true for all existing drivers.
Additionally print a message if a failing fb_set_par is detected in
fbmem.c or fbcon.c.

Although most errors should be caught by the previous fb_check_var some
errors can't as they are dynamic (memory allocations, ...) and can only be
detected while performing the operations which is forbidden in
fb_check_var.

This patch shouldn't have a negative impact on normal operation as all
drivers return 0 on success.  The impact in case of error depends heavily
on the driver and caller but it's expected to be better than before.

Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
At the moment about half of the framebuffer drivers can return an error
code in fb_set_par. Until now it would be silently ignored by fbmem.c
and fbcon.c. This patch fixes fbmem.c to return the error code and
restore var on error.

But it is not clear in which video mode the device is when fb_set_par
fails.  It would be good and reasonable if it were in the old state but
there is no guarantee that this is true for all existing drivers.
Additionally print a message if a failing fb_set_par is detected in
fbmem.c or fbcon.c.

Although most errors should be caught by the previous fb_check_var some
errors can't as they are dynamic (memory allocations, ...) and can only be
detected while performing the operations which is forbidden in
fb_check_var.

This patch shouldn't have a negative impact on normal operation as all
drivers return 0 on success.  The impact in case of error depends heavily
on the driver and caller but it's expected to be better than before.

Signed-off-by: Florian Tobias Schandinat &lt;FlorianSchandinat@gmx.de&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>video: console, use DIV_ROUND_UP</title>
<updated>2009-09-23T14:39:56+00:00</updated>
<author>
<name>Jiri Slaby</name>
<email>jirislaby@gmail.com</email>
</author>
<published>2009-09-22T23:47:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=9a4a83d2ed83da0c4b45289ca72f10205aa96589'/>
<id>9a4a83d2ed83da0c4b45289ca72f10205aa96589</id>
<content type='text'>
Use DIV_ROUND_UP explicitly instead of manual shifts and adds.  It makes
the code more readable and consistent (sometimes there were shifts,
sometimes divs).

There is no change on the assembly level (compilers should do the right
job).

Signed-off-by: Jiri Slaby &lt;jirislaby@gmail.com&gt;
Cc: Sergey Senozhatsky &lt;sergey.senozhatsky@gmail.com&gt;
Cc: Andi Kleen &lt;andi@firstfloor.org&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use DIV_ROUND_UP explicitly instead of manual shifts and adds.  It makes
the code more readable and consistent (sometimes there were shifts,
sometimes divs).

There is no change on the assembly level (compilers should do the right
job).

Signed-off-by: Jiri Slaby &lt;jirislaby@gmail.com&gt;
Cc: Sergey Senozhatsky &lt;sergey.senozhatsky@gmail.com&gt;
Cc: Andi Kleen &lt;andi@firstfloor.org&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drivers/video/console/newport_con.c: fix read outside array bounds</title>
<updated>2009-09-23T14:39:56+00:00</updated>
<author>
<name>Roel Kluin</name>
<email>roel.kluin@gmail.com</email>
</author>
<published>2009-09-22T23:47:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f7a595e98c3140f1271957aa742a6b84407620d4'/>
<id>f7a595e98c3140f1271957aa742a6b84407620d4</id>
<content type='text'>
It reads linetable[] before checking bounds of index, and ARRAY_SIZE is
required because linetable[] are unsigned shorts.

Signed-off-by: Roel Kluin &lt;roel.kluin@gmail.com&gt;
Cc: Ralf Baechle &lt;ralf@linux-mips.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
It reads linetable[] before checking bounds of index, and ARRAY_SIZE is
required because linetable[] are unsigned shorts.

Signed-off-by: Roel Kluin &lt;roel.kluin@gmail.com&gt;
Cc: Ralf Baechle &lt;ralf@linux-mips.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>includecheck fix: drivers/video, vgacon.c</title>
<updated>2009-09-20T10:31:58+00:00</updated>
<author>
<name>Jaswinder Singh Rajput</name>
<email>jaswinderrajput@gmail.com</email>
</author>
<published>2009-09-20T09:58:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=6d6c971778c5257fc815e1ebe01779fefda6293c'/>
<id>6d6c971778c5257fc815e1ebe01779fefda6293c</id>
<content type='text'>
fix the following 'make includecheck' warning:

  drivers/video/console/vgacon.c: linux/slab.h is included more than once.

Signed-off-by: Jaswinder Singh Rajput &lt;jaswinderrajput@gmail.com&gt;
Cc: Martin Mares &lt;mj@ucw.cz&gt;
Cc: mchehab@infradead.org
Cc: Sam Ravnborg &lt;sam@ravnborg.org&gt;
LKML-Reference: &lt;1247067624.4382.88.camel@ht.satnam&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
fix the following 'make includecheck' warning:

  drivers/video/console/vgacon.c: linux/slab.h is included more than once.

Signed-off-by: Jaswinder Singh Rajput &lt;jaswinderrajput@gmail.com&gt;
Cc: Martin Mares &lt;mj@ucw.cz&gt;
Cc: mchehab@infradead.org
Cc: Sam Ravnborg &lt;sam@ravnborg.org&gt;
LKML-Reference: &lt;1247067624.4382.88.camel@ht.satnam&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>sparc: Kill PROM console driver.</title>
<updated>2009-09-16T00:04:38+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2009-09-16T00:04:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=09d3f3f0e02c8a900d076c302c5c02227f33572d'/>
<id>09d3f3f0e02c8a900d076c302c5c02227f33572d</id>
<content type='text'>
Many years ago when this driver was written, it had a use, but these
days it's nothing but trouble and distributions should not enable it
in any situation.

Pretty much every console device a sparc machine could see has a
bonafide real driver, making the PROM console hack unnecessary.

If any new device shows up, we should write a driver instead of
depending upon this crutch to save us.  We've been able to take care
of this even when no chip documentation exists (sunxvr500, sunxvr2500)
so there are no excuses.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Many years ago when this driver was written, it had a use, but these
days it's nothing but trouble and distributions should not enable it
in any situation.

Pretty much every console device a sparc machine could see has a
bonafide real driver, making the PROM console hack unnecessary.

If any new device shows up, we should write a driver instead of
depending upon this crutch to save us.  We've been able to take care
of this even when no chip documentation exists (sunxvr500, sunxvr2500)
so there are no excuses.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>fbcon: don't use vc_resize() on initialization</title>
<updated>2009-08-07T17:39:56+00:00</updated>
<author>
<name>Johannes Weiner</name>
<email>hannes@cmpxchg.org</email>
</author>
<published>2009-08-06T22:07:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=0035fe00f77d2b0a1a2d001f7442136d1ec5aefa'/>
<id>0035fe00f77d2b0a1a2d001f7442136d1ec5aefa</id>
<content type='text'>
Catalin and kmemleak spotted a leak of a VC screen buffer in
vc_allocate() due to the following chain of events:

	vc_allocate()
	  visual_init(init=1)
	    vc-&gt;vc_sw-&gt;con_init(init=1)
              fbcon_init()
	        vc_resize()
	          vc-&gt;screen_buf = kmalloc()
	  vc-&gt;screen_buf = kmalloc()

The common way for the VC drivers is to set the screen dimension
parameters manually in the init case and only call vc_resize() for
!init - which allocates a screen buffer according to the new
dimensions.

fbcon instead would do vc_resize() unconditionally and afterwards set
the dimensions manually (again) for !init - i.e. completely upside
down.  The vc_resize() allocated buffer would then get lost by
vc_allocate() allocating a fresh one.

Use vc_resize() only for actual resizing to close the leak.

Set the dimensions manually only in initialization mode to remove the
redundant setting in resize mode.

The kmemleak trace from Catalin:

unreferenced object 0xde158000 (size 12288):
  comm "Xorg", pid 1439, jiffies 4294961016
  hex dump (first 32 bytes):
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
  backtrace:
    [&lt;c006f74b&gt;] __save_stack_trace+0x17/0x1c
    [&lt;c006f81d&gt;] create_object+0xcd/0x188
    [&lt;c01f5457&gt;] kmemleak_alloc+0x1b/0x3c
    [&lt;c006e303&gt;] __kmalloc+0xdb/0xe8
    [&lt;c012cc4b&gt;] vc_do_resize+0x73/0x1e0
    [&lt;c012cdf1&gt;] vc_resize+0x15/0x18
    [&lt;c011afc1&gt;] fbcon_init+0x1f9/0x2b8
    [&lt;c0129e87&gt;] visual_init+0x9f/0xdc
    [&lt;c012aff3&gt;] vc_allocate+0x7f/0xfc
    [&lt;c012b087&gt;] con_open+0x17/0x80
    [&lt;c0120e43&gt;] tty_open+0x1f7/0x2e4
    [&lt;c0072fa1&gt;] chrdev_open+0x101/0x118
    [&lt;c006ffad&gt;] __dentry_open+0x105/0x1cc
    [&lt;c00700fd&gt;] nameidata_to_filp+0x2d/0x38
    [&lt;c00788cd&gt;] do_filp_open+0x2c1/0x54c
    [&lt;c006fdff&gt;] do_sys_open+0x3b/0xb4

Reported-by: Catalin Marinas &lt;catalin.marinas@arm.com&gt;
Signed-off-by: Johannes Weiner &lt;hannes@cmpxchg.org&gt;
Tested-by: Catalin Marinas &lt;catalin.marinas@arm.com&gt;
Cc: Pekka Enberg &lt;penberg@cs.helsinki.fi&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Tested-by: Dave Young &lt;hidave.darkstar@gmail.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Catalin and kmemleak spotted a leak of a VC screen buffer in
vc_allocate() due to the following chain of events:

	vc_allocate()
	  visual_init(init=1)
	    vc-&gt;vc_sw-&gt;con_init(init=1)
              fbcon_init()
	        vc_resize()
	          vc-&gt;screen_buf = kmalloc()
	  vc-&gt;screen_buf = kmalloc()

The common way for the VC drivers is to set the screen dimension
parameters manually in the init case and only call vc_resize() for
!init - which allocates a screen buffer according to the new
dimensions.

fbcon instead would do vc_resize() unconditionally and afterwards set
the dimensions manually (again) for !init - i.e. completely upside
down.  The vc_resize() allocated buffer would then get lost by
vc_allocate() allocating a fresh one.

Use vc_resize() only for actual resizing to close the leak.

Set the dimensions manually only in initialization mode to remove the
redundant setting in resize mode.

The kmemleak trace from Catalin:

unreferenced object 0xde158000 (size 12288):
  comm "Xorg", pid 1439, jiffies 4294961016
  hex dump (first 32 bytes):
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
  backtrace:
    [&lt;c006f74b&gt;] __save_stack_trace+0x17/0x1c
    [&lt;c006f81d&gt;] create_object+0xcd/0x188
    [&lt;c01f5457&gt;] kmemleak_alloc+0x1b/0x3c
    [&lt;c006e303&gt;] __kmalloc+0xdb/0xe8
    [&lt;c012cc4b&gt;] vc_do_resize+0x73/0x1e0
    [&lt;c012cdf1&gt;] vc_resize+0x15/0x18
    [&lt;c011afc1&gt;] fbcon_init+0x1f9/0x2b8
    [&lt;c0129e87&gt;] visual_init+0x9f/0xdc
    [&lt;c012aff3&gt;] vc_allocate+0x7f/0xfc
    [&lt;c012b087&gt;] con_open+0x17/0x80
    [&lt;c0120e43&gt;] tty_open+0x1f7/0x2e4
    [&lt;c0072fa1&gt;] chrdev_open+0x101/0x118
    [&lt;c006ffad&gt;] __dentry_open+0x105/0x1cc
    [&lt;c00700fd&gt;] nameidata_to_filp+0x2d/0x38
    [&lt;c00788cd&gt;] do_filp_open+0x2c1/0x54c
    [&lt;c006fdff&gt;] do_sys_open+0x3b/0xb4

Reported-by: Catalin Marinas &lt;catalin.marinas@arm.com&gt;
Signed-off-by: Johannes Weiner &lt;hannes@cmpxchg.org&gt;
Tested-by: Catalin Marinas &lt;catalin.marinas@arm.com&gt;
Cc: Pekka Enberg &lt;penberg@cs.helsinki.fi&gt;
Cc: Krzysztof Helt &lt;krzysztof.h1@poczta.fm&gt;
Tested-by: Dave Young &lt;hidave.darkstar@gmail.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
