linux-stable.git/drivers/video/fbdev, branch v6.2.13

fbcon: set_con2fb_map needs to set con2fb_map!

2023-04-20T10:36:52+00:00

commit fffb0b52d5258554c645c966c6cbef7de50b851d upstream.

I got really badly confused in d443d9386472 ("fbcon: move more common
code into fb_open()") because we set the con2fb_map before the failure
points, which didn't look good.

But in trying to fix that I moved the assignment into the wrong path -
we need to do it for _all_ vc we take over, not just the first one
(which additionally requires the call to con2fb_acquire_newinfo).

I've figured this out because of a KASAN bug report, where the
fbcon_registered_fb and fbcon_display arrays went out of sync in
fbcon_mode_deleted() because the con2fb_map pointed at the old
fb_info, but the modes and everything was updated for the new one.

Signed-off-by: Daniel Vetter 
Reviewed-by: Javier Martinez Canillas 
Acked-by: Helge Deller 
Tested-by: Xingyuan Mo 
Fixes: d443d9386472 ("fbcon: move more common code into fb_open()")
Reported-by: Xingyuan Mo 
Cc: Thomas Zimmermann 
Cc: Sam Ravnborg 
Cc: Xingyuan Mo 
Cc: Thomas Zimmermann 
Cc: Helge Deller 
Cc:  # v5.19+
Signed-off-by: Greg Kroah-Hartman

fbcon: Fix error paths in set_con2fb_map

2023-04-20T10:36:52+00:00

commit edf79dd2172233452ff142dcc98b19d955fc8974 upstream.

This is a regressoin introduced in b07db3958485 ("fbcon: Ditch error
handling for con2fb_release_oldinfo"). I failed to realize what the if
(!err) checks. The mentioned commit was dropping the
con2fb_release_oldinfo() return value but the if (!err) was also
checking whether the con2fb_acquire_newinfo() function call above
failed or not.

Fix this with an early return statement.

Note that there's still a difference compared to the orginal state of
the code, the below lines are now also skipped on error:

	if (!search_fb_in_map(info_idx))
		info_idx = newidx;

These are only needed when we've actually thrown out an old fb_info
from the console mappings, which only happens later on.

Also move the fbcon_add_cursor_work() call into the same if block,
it's all protected by console_lock so doesn't matter when we set up
the blinking cursor delayed work anyway. This further simplifies the
control flow and allows us to ditch the found local variable.

v2: Clarify commit message (Javier)

Signed-off-by: Daniel Vetter 
Reviewed-by: Javier Martinez Canillas 
Acked-by: Helge Deller 
Tested-by: Xingyuan Mo 
Fixes: b07db3958485 ("fbcon: Ditch error handling for con2fb_release_oldinfo")
Cc: Thomas Zimmermann 
Cc: Sam Ravnborg 
Cc: Xingyuan Mo 
Cc: Thomas Zimmermann 
Cc: Helge Deller 
Cc:  # v5.19+
Signed-off-by: Greg Kroah-Hartman

fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace

2023-04-20T10:36:51+00:00

commit 6fd33a3333c7916689b8f051a185defe4dd515b0 upstream.

This is an oversight from dc5bdb68b5b3 ("drm/fb-helper: Fix vt
restore") - I failed to realize that nasty userspace could set this.

It's not pretty to mix up kernel-internal and userspace uapi flags
like this, but since the entire fb_var_screeninfo structure is uapi
we'd need to either add a new parameter to the ->fb_set_par callback
and fb_set_par() function, which has a _lot_ of users. Or some other
fairly ugly side-channel int fb_info. Neither is a pretty prospect.

Instead just correct the issue at hand by filtering out this
kernel-internal flag in the ioctl handling code.

Reviewed-by: Javier Martinez Canillas 
Acked-by: Maarten Lankhorst 
Signed-off-by: Daniel Vetter 
Fixes: dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore")
Cc: Alex Deucher 
Cc: shlomo@fastmail.com
Cc: Michel Dänzer 
Cc: Noralf Trønnes 
Cc: Thomas Zimmermann 
Cc: Daniel Vetter 
Cc: Maarten Lankhorst 
Cc: Maxime Ripard 
Cc: David Airlie 
Cc: Daniel Vetter 
Cc: dri-devel@lists.freedesktop.org
Cc:  # v5.7+
Cc: Bartlomiej Zolnierkiewicz 
Cc: Geert Uytterhoeven 
Cc: Nathan Chancellor 
Cc: Qiujun Huang 
Cc: Peter Rosin 
Cc: linux-fbdev@vger.kernel.org
Cc: Helge Deller 
Cc: Sam Ravnborg 
Cc: Geert Uytterhoeven 
Cc: Samuel Thibault 
Cc: Tetsuo Handa 
Cc: Shigeru Yoshida 
Link: https://patchwork.freedesktop.org/patch/msgid/20230404193934.472457-1-daniel.vetter@ffwll.ch
Signed-off-by: Greg Kroah-Hartman

fbdev: au1200fb: Fix potential divide by zero

2023-04-06T10:12:30+00:00

[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ]

var->pixclock can be assigned to zero by user. Without
proper check, divide by zero would occur when invoking
macro PICOS2KHZ in au1200fb_fb_check_var.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: lxfb: Fix potential divide by zero

2023-04-06T10:12:30+00:00

[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ]

var->pixclock can be assigned to zero by user. Without proper
check, divide by zero would occur in lx_set_clock.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: intelfb: Fix potential divide by zero

2023-04-06T10:12:30+00:00

[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ]

Variable var->pixclock is controlled by user and can be assigned
to zero. Without proper check, divide by zero would occur in
intelfbhw_validate_mode and intelfbhw_mode_to_hw.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: nvidia: Fix potential divide by zero

2023-04-06T10:12:30+00:00

[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ]

variable var->pixclock can be set by user. In case it
equals to zero, divide by zero would occur in nvidiafb_set_par.

Similar crashes have happened in other fbdev drivers. There
is no check and modification on var->pixclock along the call
chain to nvidia_check_var and nvidiafb_set_par. We believe it
could also be triggered in driver nvidia from user site.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: tgafb: Fix potential divide by zero

2023-04-06T10:12:29+00:00

[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ]

fb_set_var would by called when user invokes ioctl with cmd
FBIOPUT_VSCREENINFO. User-provided data would finally reach
tgafb_check_var. In case var->pixclock is assigned to zero,
divide by zero would occur when checking whether reciprocal
of var->pixclock is too high.

Similar crashes have happened in other fbdev drivers. There
is no check and modification on var->pixclock along the call
chain to tgafb_check_var. We believe it could also be triggered
in driver tgafb from user site.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()

2023-03-22T12:38:08+00:00

commit fe9ae05cfbe587dda724fcf537c00bc2f287da62 upstream.

The recent fix for the deferred I/O by the commit
  3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices")
caused a regression when the same fb device is opened/closed while
it's being used.  It resulted in a frozen screen even if something
is redrawn there after the close.  The breakage is because the patch
was made under a wrong assumption of a single open; in the current
code, fb_deferred_io_release() cleans up the page mapping of the
pageref list and it calls cancel_delayed_work_sync() unconditionally,
where both are no correct behavior for multiple opens.

This patch adds a refcount for the opens of the device, and applies
the cleanup only when all files get closed.

As both fb_deferred_io_open() and _close() are called always in the
fb_info lock (mutex), it's safe to use the normal int for the
refcounting.

Also, a useless BUG_ON() is dropped.

Fixes: 3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices")
Cc: 
Signed-off-by: Takashi Iwai 
Reviewed-by: Patrik Jakobsson 
Signed-off-by: Thomas Zimmermann 
Link: https://patchwork.freedesktop.org/patch/msgid/20230308105012.1845-1-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman

fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks

2023-03-22T12:38:07+00:00

commit 203873a535d627c668f293be0cb73e26c30f9cc7 upstream.

Find a valid modeline depending on the machine graphic card
configuration and add the fb_check_var() function to validate
Xorg provided graphics settings.

Signed-off-by: Helge Deller 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman