linux-stable.git/drivers/video/fbdev, branch v4.19.86

fbdev: fix broken menu dependencies

2019-11-24T07:20:37+00:00

[ Upstream commit aae3394ef0ef90cf00a21133357448385f13a5d4 ]

The framebuffer options and devices menu is unintentionally split
or broken because some items in it do not depend on FB (including
several under omap and mmp).
Fix this by moving FB_CMDLINE, FB_NOTIFY, and FB_CLPS711X_OLD to
just before the FB Kconfig symbol definition and by moving the
omap, omap2, and mmp menus to last, following FB_SM712.

Also, the FB_VIA dependencies are duplicated by both being inside
an "if FB_VIA/endif" block and "depends on FB_VIA", so drop the
"depends on FB_VIA" lines since they are redundant.

Fixes: ea6763c104c9 ("video/fbdev: Always built-in video= cmdline parsing")
Fixes: 5ec9653806ba ("fbdev: Make fb-notify a no-op if CONFIG_FB=n")
Fixes: ef74d46a4ef3 ("video: clps711x: Add new Cirrus Logic CLPS711X framebuffer driver")

Signed-off-by: Randy Dunlap 
Cc: Ezequiel Garcia 
Cc: Daniel Vetter 
Cc: Alexander Shiyan 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()

2019-11-24T07:20:36+00:00

[ Upstream commit e5017716adb8aa5c01c52386c1b7470101ffe9c5 ]

The "index + count" addition can overflow.  Both come directly from the
user.  This bug leads to an information leak.

Signed-off-by: Dan Carpenter 
Cc: Peter Malone 
Cc: Philippe Ombredanne 
Cc: Mathieu Malaterre 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

fbdev: sbuslib: use checked version of put_user()

2019-11-24T07:20:35+00:00

[ Upstream commit d8bad911e5e55e228d59c0606ff7e6b8131ca7bf ]

I'm not sure why the code assumes that only the first put_user() needs
an access_ok() check.  I have made all the put_user() and get_user()
calls checked.

Signed-off-by: Dan Carpenter 
Cc: Philippe Ombredanne 
Cc: Mathieu Malaterre 
Cc: Peter Malone ,
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

atmel_lcdfb: support native-mode display-timings

2019-11-24T07:20:35+00:00

[ Upstream commit 60e5e48dba72c6b59a7a9c7686ba320766913368 ]

When a device tree set a display-timing using native-mode
then according to the bindings doc this should:

    native-mode:
    The native mode for the display, in case multiple
    modes are provided.
    When omitted, assume the first node is the native.

The atmel_lcdfb used the last timing subnode and did not
respect the timing mode specified with native-mode.

Introduce use of of_get_videomode() which allowed
a nice simplification of the code while also
added support for native-mode.

As a nice side-effect this fixes a memory leak where the
data used for timings and the display_np was not freed.

Signed-off-by: Sam Ravnborg 
Cc: Nicolas Ferre 
Cc: Alexandre Belloni 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

fbdev: Ditch fb_edid_add_monspecs

2019-11-24T07:19:14+00:00

commit 3b8720e63f4a1fc6f422a49ecbaa3b59c86d5aaf upstream.

It's dead code ever since

commit 34280340b1dc74c521e636f45cd728f9abf56ee2
Author: Geert Uytterhoeven 
Date:   Fri Dec 4 17:01:43 2015 +0100

    fbdev: Remove unused SH-Mobile HDMI driver

Also with this gone we can remove the cea_modes db. This entire thing
is massively incomplete anyway, compared to the CEA parsing that
drm_edid.c does.

Acked-by: Linus Torvalds 
Cc: Tavis Ormandy 
Signed-off-by: Daniel Vetter 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20190721201956.941-1-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman

video: ssd1307fb: Start page range at page_offset

2019-10-07T16:56:30+00:00

[ Upstream commit dd9782834dd9dde3624ff1acea8859f3d3e792d4 ]

The page_offset was only applied to the end of the page range. This caused
the display updates to cause a scrolling effect on the display because the
amount of data written to the display did not match the range display
expected.

Fixes: 301bc0675b67 ("video: ssd1307fb: Make use of horizontal addressing mode")
Signed-off-by: Marko Kohtala 
Cc: Mark Rutland 
Cc: Rob Herring 
Cc: Daniel Vetter 
Cc: David Airlie 
Cc: Michal Vokáč 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20190618074111.9309-4-marko.kohtala@okoko.fi
Signed-off-by: Sasha Levin

efifb: BGRT: Improve efifb_bgrt_sanity_check

2019-10-05T11:10:07+00:00

commit 51677dfcc17f88ed754143df670ff064eae67f84 upstream.

For various reasons, at least with x86 EFI firmwares, the xoffset and
yoffset in the BGRT info are not always reliable.

Extensive testing has shown that when the info is correct, the
BGRT image is always exactly centered horizontally (the yoffset variable
is more variable and not always predictable).

This commit simplifies / improves the bgrt_sanity_check to simply
check that the BGRT image is exactly centered horizontally and skips
(re)drawing it when it is not.

This fixes the BGRT image sometimes being drawn in the wrong place.

Cc: stable@vger.kernel.org
Fixes: 88fe4ceb2447 ("efifb: BGRT: Do not copy the boot graphics for non native resolutions")
Signed-off-by: Hans de Goede 
Cc: Peter Jones ,
Signed-off-by: Bartlomiej Zolnierkiewicz 
Link: https://patchwork.freedesktop.org/patch/msgid/20190721131918.10115-1-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman

video: imsttfb: fix potential NULL pointer dereferences

2019-06-15T09:54:10+00:00

[ Upstream commit 1d84353d205a953e2381044953b7fa31c8c9702d ]

In case ioremap fails, the fix releases resources and returns
-ENOMEM to avoid NULL pointer dereferences.

Signed-off-by: Kangjie Lu 
Cc: Aditya Pakki 
Cc: Finn Thain 
Cc: Rob Herring 
Cc: Greg Kroah-Hartman 
[b.zolnierkie: minor patch summary fixup]
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

video: hgafb: fix potential NULL pointer dereference

2019-06-15T09:54:10+00:00

[ Upstream commit ec7f6aad57ad29e4e66cc2e18e1e1599ddb02542 ]

When ioremap fails, hga_vram should not be dereferenced. The fix
check the failure to avoid NULL pointer dereference.

Signed-off-by: Kangjie Lu 
Cc: Aditya Pakki 
Cc: Ferenc Bakonyi 
[b.zolnierkie: minor patch summary fixup]
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

vt/fbcon: deinitialize resources in visual_init() after failed memory allocation

2019-06-09T07:17:21+00:00

commit a1ad1cc9704f64c169261a76e1aee1cf1ae51832 upstream.

After memory allocation failure vc_allocate() doesn't clean up data
which has been initialized in visual_init(). In case of fbcon this
leads to divide-by-0 in fbcon_init() on next open of the same tty.

memory allocation in vc_allocate() may fail here:
1097:     vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL);

on next open() fbcon_init() skips vc_font.data initialization:
1088:     if (!p->fontdata) {

division by zero in fbcon_init() happens here:
1149:     new_cols /= vc->vc_font.width;

Additional check is needed in fbcon_deinit() to prevent
usage of uninitialized vc_screenbuf:

1251:        if (vc->vc_hi_font_mask && vc->vc_screenbuf)
1252:                set_vc_hi_font(vc, false);

Crash:

 #6 [ffffc90001eafa60] divide_error at ffffffff81a00be4
    [exception RIP: fbcon_init+463]
    RIP: ffffffff814b860f  RSP: ffffc90001eafb18  RFLAGS: 00010246
...
 #7 [ffffc90001eafb60] visual_init at ffffffff8154c36e
 #8 [ffffc90001eafb80] vc_allocate at ffffffff8154f53c
 #9 [ffffc90001eafbc8] con_install at ffffffff8154f624
...

Signed-off-by: Grzegorz Halat 
Reviewed-by: Oleksandr Natalenko 
Acked-by: Bartlomiej Zolnierkiewicz 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman