linux-stable.git/drivers/video/fbdev/core/fbmem.c, branch v5.10

fbmem: add margin check to fb_check_caps()

2020-09-08T11:33:01+00:00

A fb_ioctl() FBIOPUT_VSCREENINFO call with invalid xres setting
or yres setting in struct fb_var_screeninfo will result in a
KASAN: vmalloc-out-of-bounds failure in bitfill_aligned() as
the margins are being cleared. The margins are cleared in
chunks and if the xres setting or yres setting is a value of
zero upto the chunk size, the failure will occur.

Add a margin check to validate xres and yres settings.

Signed-off-by: George Kennedy 
Reported-by: syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com
Reviewed-by: Dan Carpenter 
Cc: Dhaval Giani 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/1594149963-13801-1-git-send-email-george.kennedy@oracle.com

Merge drm/drm-next into drm-misc-next

2020-08-12T18:42:08+00:00

Backmerging drm-next into drm-misc-next for nouveau and panel updates.
Resolves a conflict between ttm and nouveau, where struct ttm_mem_res got
renamed to struct ttm_resource.

Signed-off-by: Thomas Zimmermann

fbmem: pull fbcon_update_vcs() out of fb_set_var()

2020-08-04T05:37:23+00:00

syzbot is reporting OOB read bug in vc_do_resize() [1] caused by memcpy()
based on outdated old_{rows,row_size} values, for resize_screen() can
recurse into vc_do_resize() which changes vc->vc_{cols,rows} that outdates
old_{rows,row_size} values which were saved before calling resize_screen().

Daniel Vetter explained that resize_screen() should not recurse into
fbcon_update_vcs() path due to FBINFO_MISC_USEREVENT being still set
when calling resize_screen().

Instead of masking FBINFO_MISC_USEREVENT before calling fbcon_update_vcs(),
we can remove FBINFO_MISC_USEREVENT by calling fbcon_update_vcs() only if
fb_set_var() returned 0. This change assumes that it is harmless to call
fbcon_update_vcs() when fb_set_var() returned 0 without reaching
fb_notifier_call_chain().

[1] https://syzkaller.appspot.com/bug?id=c70c88cfd16dcf6e1d3c7f0ab8648b3144b5b25e

Reported-and-tested-by: syzbot 
Suggested-by: Daniel Vetter 
Signed-off-by: Tetsuo Handa 
Reported-by: kernel test robot  for missing #include
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/075b7e37-3278-cd7d-31ab-c5073cfa8e92@i-love.sakura.ne.jp

fbdev: Use fallthrough pseudo-keyword

2020-08-03T19:38:37+00:00

Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
fall-through markings when it is the case.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Sam Ravnborg 
Link: https://patchwork.freedesktop.org/patch/msgid/20200707210539.GA12530@embeddedor

fbdev: Remove trailing whitespace

2020-08-03T08:02:15+00:00

Removes trailing whitespaces in several places.

Signed-off-by: Thomas Zimmermann 
Acked-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200729134148.6855-2-tzimmermann@suse.de

fbmem: Adjust indentation in fb_prepare_logo and fb_blank

2020-01-15T16:31:47+00:00

Clang warns:

../drivers/video/fbdev/core/fbmem.c:665:3: warning: misleading
indentation; statement is not part of the previous 'else'
[-Wmisleading-indentation]
        if (fb_logo.depth > 4 && depth > 4) {
        ^
../drivers/video/fbdev/core/fbmem.c:661:2: note: previous statement is
here
        else
        ^
../drivers/video/fbdev/core/fbmem.c:1075:3: warning: misleading
indentation; statement is not part of the previous 'if'
[-Wmisleading-indentation]
        return ret;
        ^
../drivers/video/fbdev/core/fbmem.c:1072:2: note: previous statement is
here
        if (!ret)
        ^
2 warnings generated.

This warning occurs because there are spaces before the tabs on these
lines. Normalize the indentation in these functions so that it is
consistent with the Linux kernel coding style and clang no longer warns.

Fixes: 1692b37c99d5 ("fbdev: Fix logo if logo depth is less than framebuffer depth")
Link: https://github.com/ClangBuiltLinux/linux/issues/825
Signed-off-by: Nathan Chancellor 
Reviewed-by: Nick Desaulniers 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20191218030025.10064-1-natechancellor@gmail.com

fbdev: potential information leak in do_fb_ioctl()

2020-01-15T16:31:39+00:00

The "fix" struct has a 2 byte hole after ->ywrapstep and the
"fix = info->fix;" assignment doesn't necessarily clear it.  It depends
on the compiler.  The solution is just to replace the assignment with an
memcpy().

Fixes: 1f5e31d7e55a ("fbmem: don't call copy_from/to_user() with mutex held")
Signed-off-by: Dan Carpenter 
Cc: Andrew Morton 
Cc: Arnd Bergmann 
Cc: "Eric W. Biederman" 
Cc: Andrea Righi 
Cc: Daniel Vetter 
Cc: Sam Ravnborg 
Cc: Maarten Lankhorst 
Cc: Daniel Thompson 
Cc: Peter Rosin 
Cc: Jani Nikula 
Cc: Gerd Hoffmann 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20200113100132.ixpaymordi24n3av@kili.mountain

Merge drm/drm-next into drm-misc-next

2020-01-06T09:35:33+00:00

Requested, and we need v5.5-rc1 backported as our current branch is still based on v5.4.

Signed-off-by: Maarten Lankhorst

fbdev: fbmem: avoid exporting fb_center_logo

2020-01-03T13:27:42+00:00

The variable is only ever used from fbcon.c which is linked into the
same module. Therefore, the export is not needed.

Signed-off-by: Peter Rosin 
Reviewed-by: Geert Uytterhoeven 
Cc: Jonathan Corbet 
Cc: Matthew Wilcox 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20190827110854.12574-4-peda@axentia.se

fbdev: fbmem: allow overriding the number of bootup logos

2020-01-03T13:27:40+00:00

Probably most useful if you want no logo at all, or if you only want one
logo regardless of how many CPU cores you have.

Signed-off-by: Peter Rosin 
Reviewed-by: Geert Uytterhoeven 
Cc: Jonathan Corbet 
Cc: Matthew Wilcox 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20190827110854.12574-3-peda@axentia.se