linux-stable.git/drivers/video/fbdev/core, branch v5.4.58

fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

2020-07-29T08:18:43+00:00

commit 033724d6864245a11f8e04c066002e6ad22b3fd0 upstream.

syzbot is reporting general protection fault in bitfill_aligned() [1]
caused by integer underflow in bit_clear_margins(). The cause of this
problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.

If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres
is going to shrink, vc->vc_{cols,rows} will not be updated. This allows
bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or
info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will
try to overrun the __iomem region and causes general protection fault.

Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to

  new_cols = (cols ? cols : vc->vc_cols);
  new_rows = (lines ? lines : vc->vc_rows);

exception. Since cols and lines are calculated as

  cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
  rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
  cols /= vc->vc_font.width;
  rows /= vc->vc_font.height;
  vc_resize(vc, cols, rows);

in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0
and var.yres < vc->vc_font.height makes rows = 0. This means that

  const int fd = open("/dev/fb0", O_ACCMODE);
  struct fb_var_screeninfo var = { };
  ioctl(fd, FBIOGET_VSCREENINFO, &var);
  var.xres = var.yres = 1;
  ioctl(fd, FBIOPUT_VSCREENINFO, &var);

easily reproduces integer underflow bug explained above.

Of course, callers of vc_resize() are not handling vc_do_resize() failure
is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore,
as a band-aid workaround, this patch checks integer underflow in
"struct fbcon_ops"->clear_margins call, assuming that
vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not
cause integer overflow.

[1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6

Reported-and-tested-by: syzbot 
Signed-off-by: Tetsuo Handa 
Acked-by: Daniel Vetter 
Cc: stable 
Link: https://lore.kernel.org/r/20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman

fbmem: Adjust indentation in fb_prepare_logo and fb_blank

2020-04-23T08:36:43+00:00

commit 93166f5f2e4dc593cff8ca77ef828ac6f148b0f3 upstream.

Clang warns:

../drivers/video/fbdev/core/fbmem.c:665:3: warning: misleading
indentation; statement is not part of the previous 'else'
[-Wmisleading-indentation]
        if (fb_logo.depth > 4 && depth > 4) {
        ^
../drivers/video/fbdev/core/fbmem.c:661:2: note: previous statement is
here
        else
        ^
../drivers/video/fbdev/core/fbmem.c:1075:3: warning: misleading
indentation; statement is not part of the previous 'if'
[-Wmisleading-indentation]
        return ret;
        ^
../drivers/video/fbdev/core/fbmem.c:1072:2: note: previous statement is
here
        if (!ret)
        ^
2 warnings generated.

This warning occurs because there are spaces before the tabs on these
lines. Normalize the indentation in these functions so that it is
consistent with the Linux kernel coding style and clang no longer warns.

Fixes: 1692b37c99d5 ("fbdev: Fix logo if logo depth is less than framebuffer depth")
Link: https://github.com/ClangBuiltLinux/linux/issues/825
Signed-off-by: Nathan Chancellor 
Reviewed-by: Nick Desaulniers 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20191218030025.10064-1-natechancellor@gmail.com
Signed-off-by: Greg Kroah-Hartman

fbdev: potential information leak in do_fb_ioctl()

2020-04-23T08:36:43+00:00

commit d3d19d6fc5736a798b118971935ce274f7deaa82 upstream.

The "fix" struct has a 2 byte hole after ->ywrapstep and the
"fix = info->fix;" assignment doesn't necessarily clear it.  It depends
on the compiler.  The solution is just to replace the assignment with an
memcpy().

Fixes: 1f5e31d7e55a ("fbmem: don't call copy_from/to_user() with mutex held")
Signed-off-by: Dan Carpenter 
Cc: Andrew Morton 
Cc: Arnd Bergmann 
Cc: "Eric W. Biederman" 
Cc: Andrea Righi 
Cc: Daniel Vetter 
Cc: Sam Ravnborg 
Cc: Maarten Lankhorst 
Cc: Daniel Thompson 
Cc: Peter Rosin 
Cc: Jani Nikula 
Cc: Gerd Hoffmann 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20200113100132.ixpaymordi24n3av@kili.mountain
Signed-off-by: Greg Kroah-Hartman

fbcon: fix null-ptr-deref in fbcon_switch

2020-04-13T08:48:14+00:00

commit b139f8b00db4a8ea75a4174346eafa48041aa489 upstream.

Set logo_shown to FBCON_LOGO_CANSHOW when the vc was deallocated.

syzkaller report: https://lkml.org/lkml/2020/3/27/403
general protection fault, probably for non-canonical address
0xdffffc000000006c: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000360-0x0000000000000367]
RIP: 0010:fbcon_switch+0x28f/0x1740
drivers/video/fbdev/core/fbcon.c:2260

Call Trace:
redraw_screen+0x2a8/0x770 drivers/tty/vt/vt.c:1008
vc_do_resize+0xfe7/0x1360 drivers/tty/vt/vt.c:1295
fbcon_init+0x1221/0x1ab0 drivers/video/fbdev/core/fbcon.c:1219
visual_init+0x305/0x5c0 drivers/tty/vt/vt.c:1062
do_bind_con_driver+0x536/0x890 drivers/tty/vt/vt.c:3542
do_take_over_console+0x453/0x5b0 drivers/tty/vt/vt.c:4122
do_fbcon_takeover+0x10b/0x210 drivers/video/fbdev/core/fbcon.c:588
fbcon_fb_registered+0x26b/0x340 drivers/video/fbdev/core/fbcon.c:3259
do_register_framebuffer drivers/video/fbdev/core/fbmem.c:1664 [inline]
register_framebuffer+0x56e/0x980 drivers/video/fbdev/core/fbmem.c:1832
dlfb_usb_probe.cold+0x1743/0x1ba3 drivers/video/fbdev/udlfb.c:1735
usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:374

accessing vc_cons[logo_shown].d->vc_top causes the bug.

Reported-by: syzbot+732528bae351682f1f27@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang 
Acked-by: Sam Ravnborg 
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20200329085647.25133-1-hqjagain@gmail.com
Signed-off-by: Greg Kroah-Hartman

backlight: drop EARLY_EVENT_BLANK support

2019-08-05T19:52:53+00:00

There was no users left - so drop the code to support EARLY_EVENT_BLANK.
This patch removes the support in backlight,
and drop the notifier in fbmem.

That EARLY_EVENT_BLANK is not used can be verified that no driver set any of:

    lcd_ops.early_set_power()
    lcd_ops.r_early_set_power()

Noticed while browsing backlight code for other reasons.

v2:
- Fix changelog to say "EARLY_EVENT_BLANK" (Daniel)

Signed-off-by: Sam Ravnborg 
Cc: Lee Jones 
Cc: Daniel Thompson 
Cc: Jingoo Han 
Cc: Bartlomiej Zolnierkiewicz 
Cc: Daniel Vetter 
Cc: Sam Ravnborg 
Cc: Maarten Lankhorst 
Cc: "Michał Mirosław" 
Cc: Peter Rosin 
Cc: Gerd Hoffmann 
Cc: dri-devel@lists.freedesktop.org
Cc: linux-fbdev@vger.kernel.org
Reviewed-by: Daniel Vetter 
Acked-by: Daniel Thompson 
Acked-by: Bartlomiej Zolnierkiewicz 
Acked-by: Lee Jones 
Link: https://patchwork.freedesktop.org/patch/msgid/20190725143224.GB31803@ravnborg.org

fbmem: remove redundant assignment to err

2019-07-23T15:14:22+00:00

Variable err is initialized to a value that is never read and it
is re-assigned later.  The initialization is redundant and can
be removed.

Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King 
Cc: Daniel Vetter 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20190624223724.13629-1-colin.king@canonical.com

fbdev: Ditch fb_edid_add_monspecs

2019-07-23T12:17:22+00:00

It's dead code ever since

commit 34280340b1dc74c521e636f45cd728f9abf56ee2
Author: Geert Uytterhoeven 
Date:   Fri Dec 4 17:01:43 2015 +0100

    fbdev: Remove unused SH-Mobile HDMI driver

Also with this gone we can remove the cea_modes db. This entire thing
is massively incomplete anyway, compared to the CEA parsing that
drm_edid.c does.

Acked-by: Linus Torvalds 
Cc: Tavis Ormandy 
Signed-off-by: Daniel Vetter 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20190721201956.941-1-daniel.vetter@ffwll.ch

fbcon: Export fbcon_update_vcs

2019-06-19T09:42:39+00:00

I failed to spot this while compile-testing. Oops.

Reported-by: kbuild test robot 
Fixes: 9e1467002630 ("fbcon: replace FB_EVENT_MODE_CHANGE/_ALL with direct calls")
Cc: Sam Ravnborg 
Cc: Daniel Vetter 
Cc: Maarten Lankhorst 
Cc: Daniel Thompson 
Cc: Lee Jones 
Cc: Jingoo Han 
Cc: Bartlomiej Zolnierkiewicz 
Cc: Daniel Vetter 
Cc: Hans de Goede 
Cc: Yisheng Xie 
Cc: "Michał Mirosław" 
Cc: Peter Rosin 
Cc: Mikulas Patocka 
Cc: linux-fbdev@vger.kernel.org
Cc: Gerd Hoffmann 
Cc: Geert Uytterhoeven 
Cc: Lukas Wunner 
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Daniel Vetter 
Signed-off-by: Maarten Lankhorst 
Link: https://patchwork.freedesktop.org/patch/msgid/20190619081115.27921-1-daniel.vetter@ffwll.ch

fbcon: Document what I learned about fbcon locking

2019-06-13T08:07:09+00:00

It's not pretty.

Signed-off-by: Daniel Vetter 
Reviewed-by: Sam Ravnborg 
Reviewed-by: Maarten Lankhorst 
Cc: Daniel Vetter 
Cc: Bartlomiej Zolnierkiewicz 
Cc: Hans de Goede 
Cc: Yisheng Xie 
Link: https://patchwork.freedesktop.org/patch/msgid/20190528090304.9388-32-daniel.vetter@ffwll.ch

fbcon: Call con2fb_map functions directly

2019-06-12T18:30:39+00:00

These are actually fbcon ioctls which just happen to be exposed
through /dev/fb*. They completely ignore which fb_info they're called
on, and I think the userspace tool even hardcodes to /dev/fb0.

Hence just forward the entire thing to fbcon.c wholesale.

Note that this patch drops the fb_lock/unlock on the set side. Since
the ioctl can operate on any fb (as passed in through
con2fb.framebuffer) this is bogus. Also note that fbcon.c in general
never calls fb_lock on anything, so this has been badly broken
already.

With this the last user of the fbcon notifier callback is gone, and we
can garbage collect that too.

v2: add missing uaccess.h include (alpha fails to compile otherwise),
reported by kbuild.

v3: Remember to also drop the #defines (Maarten)

v4: Add the static inline to dummy functions.

Signed-off-by: Daniel Vetter 
Reviewed-by: Sam Ravnborg 
Reviewed-by: Maarten Lankhorst 
Cc: Maarten Lankhorst 
Cc: Daniel Vetter 
Cc: Bartlomiej Zolnierkiewicz 
Cc: Hans de Goede 
Cc: Yisheng Xie 
Cc: "Michał Mirosław" 
Cc: Peter Rosin 
Cc: Mikulas Patocka 
Link: https://patchwork.freedesktop.org/patch/msgid/20190528090304.9388-31-daniel.vetter@ffwll.ch