linux-stable.git/drivers/video, branch linux-2.6.34.y

video:uvesafb: Fix oops that uvesafb try to execute NX-protected page

2014-02-10T21:11:38+00:00

commit b78f29ca0516266431688c5eb42d39ce42ec039a upstream.

This patch fix the oops below that catched in my machine

[   81.560602] uvesafb: NVIDIA Corporation, GT216 Board - 0696a290, Chip Rev   , OEM: NVIDIA, VBE v3.0
[   81.609384] uvesafb: protected mode interface info at c000:d350
[   81.609388] uvesafb: pmi: set display start = c00cd3b3, set palette = c00cd40e
[   81.609390] uvesafb: pmi: ports = 3b4 3b5 3ba 3c0 3c1 3c4 3c5 3c6 3c7 3c8 3c9 3cc 3ce 3cf 3d0 3d1 3d2 3d3 3d4 3d5 3da
[   81.614558] uvesafb: VBIOS/hardware doesn't support DDC transfers
[   81.614562] uvesafb: no monitor limits have been set, default refresh rate will be used
[   81.614994] uvesafb: scrolling: ypan using protected mode interface, yres_virtual=4915
[   81.744147] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[   81.744153] BUG: unable to handle kernel paging request at c00cd3b3
[   81.744159] IP: [] 0xc00cd3b2
[   81.744167] *pdpt = 00000000016d6001 *pde = 0000000001c7b067 *pte = 80000000000cd163
[   81.744171] Oops: 0011 [#1] SMP
[   81.744174] Modules linked in: uvesafb(+) cfbcopyarea cfbimgblt cfbfillrect
[   81.744178]
[   81.744181] Pid: 3497, comm: modprobe Not tainted 3.3.0-rc4NX+ #71 Acer            Aspire 4741                    /Aspire 4741
[   81.744185] EIP: 0060:[] EFLAGS: 00010246 CPU: 0
[   81.744187] EIP is at 0xc00cd3b3
[   81.744189] EAX: 00004f07 EBX: 00000000 ECX: 00000000 EDX: 00000000
[   81.744191] ESI: f763f000 EDI: f763f6e8 EBP: f57f3a0c ESP: f57f3a00
[   81.744192]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[   81.744195] Process modprobe (pid: 3497, ti=f57f2000 task=f748c600 task.ti=f57f2000)
[   81.744196] Stack:
[   81.744197]  f82512c5 f759341c 00000000 f57f3a30 c124a9bc 00000001 00000001 000001e0
[   81.744202]  f8251280 f763f000 f7593400 00000000 f57f3a40 c12598dd f5c0c000 00000000
[   81.744206]  f57f3b10 c1255efe c125a21a 00000006 f763f09c 00000000 c1c6cb60 f7593400
[   81.744210] Call Trace:
[   81.744215]  [] ? uvesafb_pan_display+0x45/0x60 [uvesafb]
[   81.744222]  [] fb_pan_display+0x10c/0x160
[   81.744226]  [] ? uvesafb_vbe_find_mode+0x180/0x180 [uvesafb]
[   81.744230]  [] bit_update_start+0x1d/0x50
[   81.744232]  [] fbcon_switch+0x39e/0x550
[   81.744235]  [] ? bit_cursor+0x4ea/0x560
[   81.744240]  [] redraw_screen+0x12b/0x220
[   81.744245]  [] ? tty_do_resize+0x3b/0xc0
[   81.744247]  [] vc_do_resize+0x3d2/0x3e0
[   81.744250]  [] vc_resize+0x14/0x20
[   81.744253]  [] fbcon_init+0x29d/0x500
[   81.744255]  [] ? set_inverse_trans_unicode+0xe4/0x110
[   81.744258]  [] visual_init+0xb8/0x150
[   81.744261]  [] bind_con_driver+0x16c/0x360
[   81.744264]  [] ? register_con_driver+0x6e/0x190
[   81.744267]  [] take_over_console+0x41/0x50
[   81.744269]  [] fbcon_takeover+0x6a/0xd0
[   81.744272]  [] fbcon_event_notify+0x758/0x790
[   81.744277]  [] notifier_call_chain+0x42/0xb0
[   81.744280]  [] __blocking_notifier_call_chain+0x60/0x90
[   81.744283]  [] blocking_notifier_call_chain+0x1a/0x20
[   81.744285]  [] fb_notifier_call_chain+0x11/0x20
[   81.744288]  [] register_framebuffer+0x1d9/0x2b0
[   81.744293]  [] ? ioremap_wc+0x33/0x40
[   81.744298]  [] uvesafb_probe+0xaba/0xc40 [uvesafb]
[   81.744302]  [] platform_drv_probe+0xf/0x20
[   81.744306]  [] driver_probe_device+0x68/0x170
[   81.744309]  [] __device_attach+0x41/0x50
[   81.744313]  [] bus_for_each_drv+0x48/0x70
[   81.744316]  [] device_attach+0x83/0xa0
[   81.744319]  [] ? __driver_attach+0x90/0x90
[   81.744321]  [] bus_probe_device+0x6f/0x90
[   81.744324]  [] device_add+0x5e5/0x680
[   81.744329]  [] ? kvasprintf+0x43/0x60
[   81.744332]  [] ? kobject_set_name_vargs+0x64/0x70
[   81.744335]  [] ? kobject_set_name_vargs+0x64/0x70
[   81.744339]  [] platform_device_add+0xff/0x1b0
[   81.744343]  [] uvesafb_init+0x50/0x9b [uvesafb]
[   81.744346]  [] do_one_initcall+0x2f/0x170
[   81.744350]  [] ? uvesafb_is_valid_mode+0x66/0x66 [uvesafb]
[   81.744355]  [] sys_init_module+0xf4/0x1410
[   81.744359]  [] ? vfsmount_lock_local_unlock_cpu+0x30/0x30
[   81.744363]  [] sysenter_do_call+0x12/0x36
[   81.744365] Code: f5 00 00 00 32 f6 66 8b da 66 d1 e3 66 ba d4 03 8a e3 b0 1c 66 ef b0 1e 66 ef 8a e7 b0 1d 66 ef b0 1f 66 ef e8 fa 00 00 00 61 c3 <60> e8 c8 00 00 00 66 8b f3 66 8b da 66 ba d4 03 b0 0c 8a e5 66
[   81.744388] EIP: [] 0xc00cd3b3 SS:ESP 0068:f57f3a00
[   81.744391] CR2: 00000000c00cd3b3
[   81.744393] ---[ end trace 18b2c87c925b54d6 ]---

Signed-off-by: Wang YanQing 
Cc: Michal Januszewski 
Cc: Alan Cox 
Signed-off-by: Florian Tobias Schandinat 
Signed-off-by: Paul Gortmaker

carminefb: Fix module parameters permissions

2012-08-17T19:35:37+00:00

commit c84c14224bbca6ec60d5851fcc87be0e34df2f44 upstream.

The third parameter of module_param is supposed to be an octal value.
The missing leading "0" causes the following:

$ ls -l /sys/module/carminefb/parameters/
total 0
-rw-rwxr-- 1 root root 4096 Jul  8 08:55 fb_displays
-rw-rwxr-- 1 root root 4096 Jul  8 08:55 fb_mode
-rw-rwxr-- 1 root root 4096 Jul  8 08:55 fb_mode_str

After fixing the perm parameter, we get the expected:

$ ls -l /sys/module/carminefb/parameters/
total 0
-r--r--r-- 1 root root 4096 Jul  8 08:56 fb_displays
-r--r--r-- 1 root root 4096 Jul  8 08:56 fb_mode
-r--r--r-- 1 root root 4096 Jul  8 08:56 fb_mode_str

Signed-off-by: Jean Delvare 
Cc: Paul Mundt 
Cc: Sebastian Siewior 
Signed-off-by: Paul Mundt 
Signed-off-by: Paul Gortmaker

backlight: MacBookAir3,1(3,2) mbp-nvidia-bl support

2012-03-14T14:57:49+00:00

commit bd760e1e5b34351e0705705e5163cb89c1316d71 upstream.

Add support for the MacBookAir3,1 and MacBookAir3,2 to the mbp-nvidia-bl
driver.

Signed-off-by: Edgar (gimli) Hucek 
Acked-by: Richard Purdie 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

fbcon: Bugfix soft cursor detection in Tile Blitting

2011-06-26T16:47:14+00:00

commit d6244bc0ed0c52a795e6f4dcab3886daf3e74fac upstream.

Use mask 0x10 for "soft cursor" detection on in function tile_cursor.
(Tile Blitting Operation in framebuffer console).

The old mask 0x01 for vc_cursor_type detects CUR_NONE, CUR_LOWER_THIRD
and every second mode value as "software cursor". This hides the cursor
for these modes (cursor.mode = 0). But, only CUR_NONE or "software cursor"
should hide the cursor.
See also 0x10 in functions add_softcursor, bit_cursor and cw_cursor.

Signed-off-by: Henry Nestler 
Signed-off-by: Paul Mundt 
Signed-off-by: Paul Gortmaker

efifb: support the EFI framebuffer on more Apple hardware

2011-04-17T20:15:56+00:00

commit a5757c2a474a15f87e5baa9a4caacc31cde2bae6 upstream.

Enable the EFI framebuffer on 14 more Macs, including the iMac11,1
iMac10,1 iMac8,1 Macmini3,1 Macmini4,1 MacBook5,1 MacBook6,1 MacBook7,1
MacBookPro2,2 MacBookPro5,2 MacBookPro5,3 MacBookPro6,1 MacBookPro6,2 and
MacBookPro7,1

Information gathered from various user submissions.

    https://bugzilla.redhat.com/show_bug.cgi?id=528232
    http://ubuntuforums.org/showthread.php?t=1557326

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Luke Macken 
Signed-off-by: Peter Jones 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

backlight: grab ops_lock before testing bd->ops

2011-04-17T20:15:52+00:00

commit d1d73578e053b981c3611e5a211534290d24a5eb upstream.

According to the comment describing ops_lock in the definition of struct
backlight_device and when comparing with other functions in backlight.c
the mutex must be hold when checking ops to be non-NULL.

Fixes a problem added by c835ee7f4154992e6 ("backlight: Add suspend/resume
support to the backlight core") in Jan 2009.

Signed-off-by: Uwe Kleine-König 
Acked-by: Richard Purdie 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

efifb: check that the base address is plausible on pci systems

2011-04-17T20:15:47+00:00

commit 85a00d9bbfb4704fbf368944b1cb9fed8f1598c5 upstream.

Some Apple machines have identical DMI data but different memory
configurations for the video.  Given that, check that the address in our
table is actually within the range of a PCI BAR on a VGA device in the
machine.

This also fixes up the return value from set_system(), which has always
been wrong, but never resulted in bad behavior since there's only ever
been one matching entry in the dmi table.

The patch

1) stops people's machines from crashing when we get their display wrong,
   which seems to be unfortunately inevitable,

2) allows us to support identical dmi data with differing video memory
   configurations

This also adds me as the efifb maintainer, since I've effectively been
acting as such for quite some time.

Signed-off-by: Peter Jones 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

viafb: use proper register for colour when doing fill ops

2011-04-17T20:15:42+00:00

commit efd4f6398dc92b5bf392670df862f42a19f34cf2 upstream.

The colour was written to a wrong register for fillrect operations.
This sometimes caused empty console space (for example after 'clear')
to have a different colour than desired. Fix this by writing to the
correct register.
Many thanks to Daniel Drake and Jon Nettleton for pointing out this
issue and pointing me in the right direction for the fix.

Fixes http://dev.laptop.org/ticket/9323

Signed-off-by: Florian Tobias Schandinat 
Cc: Joseph Chan 
Cc: Daniel Drake 
Cc: Jon Nettleton 
Signed-off-by: Paul Gortmaker

drivers/video/via/ioctl.c: prevent reading uninitialized stack memory

2011-01-06T23:08:02+00:00

commit b4aaa78f4c2f9cde2f335b14f4ca30b01f9651ca upstream.

The VIAFB_GET_INFO device ioctl allows unprivileged users to read 246
bytes of uninitialized stack memory, because the "reserved" member of
the viafb_ioctl_info struct declared on the stack is not altered or
zeroed before being copied back to the user.  This patch takes care of
it.

Signed-off-by: Dan Rosenberg 
Signed-off-by: Florian Tobias Schandinat 
Signed-off-by: Paul Gortmaker

drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory

2011-01-06T23:08:00+00:00

commit fd02db9de73faebc51240619c7c7f99bee9f65c7 upstream.

The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes
of uninitialized stack memory, because the "reserved" member of the
fb_vblank struct declared on the stack is not altered or zeroed before
being copied back to the user.  This patch takes care of it.

Signed-off-by: Dan Rosenberg 
Cc: Thomas Winischhofer 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker