linux-stable.git/drivers/video/fbdev, branch linux-4.9.y

fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()

2023-01-07T11:07:27+00:00

[ Upstream commit a94371040712031ba129c7e9d8ff04a06a2f8207 ]

If an error occurs after a successful uvesafb_init_mtrr() call, it must be
undone by a corresponding arch_phys_wc_del() call, as already done in the
remove function.

This has been added in the remove function in commit 63e28a7a5ffc
("uvesafb: Clean up MTRR code")

Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Signed-off-by: Christophe JAILLET 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: vermilion: decrease reference count in error path

2023-01-07T11:07:27+00:00

[ Upstream commit 001f2cdb952a9566c77fb4b5470cc361db5601bb ]

pci_get_device() will increase the reference count for the returned
pci_dev. For the error path, we need to use pci_dev_put() to decrease
the reference count.

Fixes: dbe7e429fedb ("vmlfb: framebuffer driver for Intel Vermilion Range")
Signed-off-by: Xiongfeng Wang 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: via: Fix error in via_core_init()

2023-01-07T11:07:27+00:00

[ Upstream commit 5886b130de953cfb8826f7771ec8640a79934a7f ]

via_core_init() won't exit the driver when pci_register_driver() failed.
Exit the viafb-i2c and the viafb-gpio in failed path to prevent error.

VIA Graphics Integration Chipset framebuffer 2.4 initializing
Error: Driver 'viafb-i2c' is already registered, aborting...
Error: Driver 'viafb-gpio' is already registered, aborting...

Fixes: 7582eb9be85f ("viafb: Turn GPIO and i2c into proper platform devices")
Signed-off-by: Shang XiaoJing 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: pm2fb: fix missing pci_disable_device()

2023-01-07T11:07:27+00:00

[ Upstream commit ed359a464846b48f76ea6cc5cd8257e545ac97f4 ]

Add missing pci_disable_device() in error path of probe() and remove() path.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yang Yingliang 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: ssd1307fb: Drop optional dependency

2023-01-07T11:07:27+00:00

[ Upstream commit 025e3b507a3a8e1ee96a3112bb67495c77d6cdb6 ]

Only a single out of three devices need a PWM, so from driver it's
optional. Moreover it's a single driver in the entire kernel that
currently selects PWM. Unfortunately this selection is a root cause
of the circular dependencies when we want to enable optional PWM
for some other drivers that select GPIOLIB.

Fixes: a2ed00da5047 ("drivers/video: add support for the Solomon SSD1307 OLED Controller")
Signed-off-by: Andy Shevchenko 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

Revert "fbdev: fb_pm2fb: Avoid potential divide by zero error"

2022-12-08T10:15:42+00:00

This reverts commit 6577e903a9e193ad70f2db92eba57c4f335afd1a. It's a
duplicate of a commit that is already in this tree
(0f1174f4972ea9fad6becf8881d71adca8e9ca91).

Signed-off-by: Ulrich Hecht 
Signed-off-by: Greg Kroah-Hartman

fbdev: smscufx: Fix several use-after-free bugs

2022-11-03T14:49:16+00:00

commit cc67482c9e5f2c80d62f623bcc347c29f9f648e1 upstream.

Several types of UAFs can occur when physically removing a USB device.

Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and
in this function, there is kref_put() that finally calls ufx_free().

This fix prevents multiple UAFs.

Signed-off-by: Hyunwoo Kim 
Link: https://lore.kernel.org/linux-fbdev/20221011153436.GA4446@ubuntu/
Cc: 
Signed-off-by: Helge Deller 
Signed-off-by: Greg Kroah-Hartman

fbdev: smscufx: Fix use-after-free in ufx_ops_open()

2022-10-26T11:15:37+00:00

commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c upstream.

A race condition may occur if the user physically removes the
USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.

Signed-off-by: Hyunwoo Kim 
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller 
Signed-off-by: Greg Kroah-Hartman

parisc: fbdev/stifb: Align graphics memory size to 4MB

2022-10-26T11:15:37+00:00

commit aca7c13d3bee81a968337a5515411409ae9d095d upstream.

Independend of the current graphics resolution, adjust the reported
graphics card memory size to the next 4MB boundary.
This fixes the fbtest program which expects a naturally aligned size.

Signed-off-by: Helge Deller 
Cc: 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write

2022-09-28T08:55:44+00:00

[ Upstream commit a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 ]

In pxa3xx_gcu_write, a count parameter of type size_t is passed to words of
type int.  Then, copy_from_user() may cause a heap overflow because it is used
as the third argument of copy_from_user().

Signed-off-by: Hyunwoo Kim 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin