linux-stable.git/drivers/video, branch v4.1.45 Linux kernel stable tree video: fbdev: cobalt_lcdfb: Handle return NULL error from devm_ioremap 2017-09-10T20:35:56+00:00 Arvind Yadav arvind.yadav.cs@gmail.com 2016-12-13T08:20:52+00:00 9de0a4e3ab8a8eaad4c40f3cb892778600fbf5f7 [ Upstream commit 4dcd19bfabaee8f9f4bcf203afba09b98ccbaf76 ] Here, If devm_ioremap will fail. It will return NULL. Kernel can run into a NULL-pointer dereference. This error check will avoid NULL pointer dereference. Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> Acked-by: Yoichi Yuasa <yuasa@linux-mips.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> 
[ Upstream commit 4dcd19bfabaee8f9f4bcf203afba09b98ccbaf76 ]

Here, If devm_ioremap will fail. It will return NULL.
Kernel can run into a NULL-pointer dereference.
This error check will avoid NULL pointer dereference.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Acked-by: Yoichi Yuasa <yuasa@linux-mips.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
xen, fbfront: fix connecting to backend 2017-05-17T19:08:21+00:00 Juergen Gross jgross@suse.com 2017-04-07T15:28:23+00:00 82bfc1d9bc5d17034c0b78a51a3071623fd89293 [ Upstream commit 9121b15b5628b38b4695282dc18c553440e0f79b ] Connecting to the backend isn't working reliably in xen-fbfront: in case XenbusStateInitWait of the backend has been missed the backend transition to XenbusStateConnected will trigger the connected state only without doing the actions required when the backend has connected. Cc: stable@vger.kernel.org Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> 
[ Upstream commit 9121b15b5628b38b4695282dc18c553440e0f79b ]

Connecting to the backend isn't working reliably in xen-fbfront: in
case XenbusStateInitWait of the backend has been missed the backend
transition to XenbusStateConnected will trigger the connected state
only without doing the actions required when the backend has
connected.

Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
fbdev: color map copying bounds checking 2017-03-06T22:31:11+00:00 Kees Cook keescook@chromium.org 2017-01-24T23:18:24+00:00 a94f76f379dcc375f00d32194954f6c4dd1644c9 [ Upstream commit 2dc705a9930b4806250fbf5a76e55266e59389f2 ] Copying color maps to userspace doesn't check the value of to->start, which will cause kernel heap buffer OOB read due to signedness wraps. CVE-2016-8405 Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kees Cook <keescook@chromium.org> Reported-by: Peter Pi (@heisecode) of Trend Micro Cc: Min Chong <mchong@google.com> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> 
[ Upstream commit 2dc705a9930b4806250fbf5a76e55266e59389f2 ]

Copying color maps to userspace doesn't check the value of to->start,
which will cause kernel heap buffer OOB read due to signedness wraps.

CVE-2016-8405

Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Peter Pi (@heisecode) of Trend Micro
Cc: Min Chong <mchong@google.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
fbdev: da8xx-fb: fix videomodes of lcd panels 2016-07-11T03:07:12+00:00 Sushaanth Srirangapathi sushaanth.s@ti.com 2016-02-29T13:12:19+00:00 a5e1649e0c4382a0994e91d958ffa70aa11ac226 [ Upstream commit 713fced8d10fa1c759c8fb6bf9aaa681bae68cad ] Commit 028cd86b794f4a ("video: da8xx-fb: fix the polarities of the hsync/vsync pulse") fixes polarities of HSYNC/VSYNC pulse but forgot to update known_lcd_panels[] which had sync values according to old logic. This breaks LCD at least on DA850 EVM. This patch fixes this issue and I have tested this for panel "Sharp_LK043T1DG01" using DA850 EVM board. Fixes: 028cd86b794f4a ("video: da8xx-fb: fix the polarities of the hsync/vsync pulse") Signed-off-by: Sushaanth Srirangapathi <sushaanth.s@ti.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit 713fced8d10fa1c759c8fb6bf9aaa681bae68cad ]

Commit 028cd86b794f4a ("video: da8xx-fb: fix the polarities of the
hsync/vsync pulse") fixes polarities of HSYNC/VSYNC pulse but
forgot to update known_lcd_panels[] which had sync values
according to old logic. This breaks LCD at least on DA850 EVM.

This patch fixes this issue and I have tested this for panel
"Sharp_LK043T1DG01" using DA850 EVM board.

Fixes: 028cd86b794f4a ("video: da8xx-fb: fix the polarities of the hsync/vsync pulse")
Signed-off-by: Sushaanth Srirangapathi <sushaanth.s@ti.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND" 2016-07-11T03:07:10+00:00 Arnd Bergmann arnd@arndb.de 2016-02-16T15:03:23+00:00 372574134cc15a03608d87a3577885b049e40db3 [ Upstream commit 13aa38e291bdd4e4018f40dd2f75e464814dcbf3 ] The Xen framebuffer driver selects the xen keyboard driver, so the latter will be built-in if XEN_FBDEV_FRONTEND=y. However, when CONFIG_INPUT is a loadable module, this configuration cannot work. On mainline kernels, the symbol will be enabled but not used, while in combination with a patch I have to detect such useless configurations, we get the expected link failure: drivers/input/built-in.o: In function `xenkbd_remove': xen-kbdfront.c:(.text+0x2f0): undefined reference to `input_unregister_device' xen-kbdfront.c:(.text+0x30e): undefined reference to `input_unregister_device' This removes the extra "select", as it just causes more trouble than it helps. In theory, some defconfig file might break if it has XEN_FBDEV_FRONTEND in it but not INPUT_XEN_KBDDEV_FRONTEND. The Kconfig fragment we ship in the kernel (kernel/configs/xen.config) however already enables both, and anyone using an old .config file would keep having both enabled. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Suggested-by: David Vrabel <david.vrabel@citrix.com> Fixes: 36c1132e34bd ("xen kconfig: fix select INPUT_XEN_KBDDEV_FRONTEND") Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> 
[ Upstream commit 13aa38e291bdd4e4018f40dd2f75e464814dcbf3 ]

The Xen framebuffer driver selects the xen keyboard driver, so the latter
will be built-in if XEN_FBDEV_FRONTEND=y. However, when CONFIG_INPUT
is a loadable module, this configuration cannot work. On mainline kernels,
the symbol will be enabled but not used, while in combination with
a patch I have to detect such useless configurations, we get the
expected link failure:

drivers/input/built-in.o: In function `xenkbd_remove':
xen-kbdfront.c:(.text+0x2f0): undefined reference to `input_unregister_device'
xen-kbdfront.c:(.text+0x30e): undefined reference to `input_unregister_device'

This removes the extra "select", as it just causes more trouble than
it helps. In theory, some defconfig file might break if it has
XEN_FBDEV_FRONTEND in it but not INPUT_XEN_KBDDEV_FRONTEND. The Kconfig
fragment we ship in the kernel (kernel/configs/xen.config) however
already enables both, and anyone using an old .config file would
keep having both enabled.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: David Vrabel <david.vrabel@citrix.com>
Fixes: 36c1132e34bd ("xen kconfig: fix select INPUT_XEN_KBDDEV_FRONTEND")
Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
fbdev: select versatile helpers for the integrator 2015-10-22T21:43:20+00:00 Linus Walleij linus.walleij@linaro.org 2015-07-28T13:31:12+00:00 1fc6fc1d5b9dc9c878b2b1c044e079b193e6cb92 commit 2701fa0864ecb9e49d47a4aa1c02f172ab79639a upstream. Commit 11c32d7b6274cb0f554943d65bd4a126c4a86dcd "video: move Versatile CLCD helpers" missed the fact that the Integrator/CP is also using the helper, and as a result the platform got only stubs and no graphics. Add this as a default selection to Kconfig so we have graphics again. Fixes: 11c32d7b6274 (video: move Versatile CLCD helpers) Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 2701fa0864ecb9e49d47a4aa1c02f172ab79639a upstream.

Commit 11c32d7b6274cb0f554943d65bd4a126c4a86dcd
"video: move Versatile CLCD helpers" missed the fact
that the Integrator/CP is also using the helper, and
as a result the platform got only stubs and no graphics.
Add this as a default selection to Kconfig so we have
graphics again.

Fixes: 11c32d7b6274 (video: move Versatile CLCD helpers)
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
video: mxsfb: Make sure axi clock is enabled when accessing registers 2015-07-21T17:10:05+00:00 Liu Ying Ying.Liu@freescale.com 2015-04-03T04:51:05+00:00 ab12dcd70c11074e6ed28b0304f059a075e33db0 commit 2fa3b4c4a78a5db3502ab9e32630ea660ff923d0 upstream. The LCDIF engines embedded in i.MX6sl and i.MX6sx SoCs need the axi clock as the engine's system clock. The clock should be enabled when accessing LCDIF registers, otherwise the kernel would hang up. We should also keep the clock enabled when the engine is being active to scan out frames from memory. This patch makes sure the axi clock is enabled when accessing registers so that the kernel hang up issue can be fixed. Reported-by: Peter Chen <peter.chen@freescale.com> Tested-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Liu Ying <Ying.Liu@freescale.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 2fa3b4c4a78a5db3502ab9e32630ea660ff923d0 upstream.

The LCDIF engines embedded in i.MX6sl and i.MX6sx SoCs need the axi clock
as the engine's system clock.  The clock should be enabled when accessing
LCDIF registers, otherwise the kernel would hang up.  We should also keep
the clock enabled when the engine is being active to scan out frames from
memory.  This patch makes sure the axi clock is enabled when accessing
registers so that the kernel hang up issue can be fixed.

Reported-by: Peter Chen <peter.chen@freescale.com>
Tested-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Liu Ying <Ying.Liu@freescale.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
backlight: pwm: Handle EPROBE_DEFER while requesting the PWM 2015-05-26T07:44:59+00:00 Nicolas Ferre nicolas.ferre@atmel.com 2015-02-19T09:30:14+00:00 68feaca0b13e453aa14ee064c1736202b48b342f When trying to request the PWM device with devm_pwm_get(), the EPROBE_DEFER flag is not handled properly. It can lead to the PWM not being found. Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com> Acked-by: Thierry Reding <thierry.reding@gmail.com> Signed-off-by: Lee Jones <lee.jones@linaro.org> 
When trying to request the PWM device with devm_pwm_get(), the EPROBE_DEFER
flag is not handled properly. It can lead to the PWM not being found.

Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Merge tag 'fbdev-4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux 2015-04-20T22:16:25+00:00 Linus Torvalds torvalds@linux-foundation.org 2015-04-20T22:16:25+00:00 bf2ae5d337cd09dfee3041364a36c5214cc7faf9 Pull fbdev updates from Tomi Valkeinen: "Small fixes and improvements to various fbdev drivers" * tag 'fbdev-4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: (24 commits) omapdss: extend pm notifier to handle hibernation OMAPDSS: Correct video ports description file path in DT binding doc OMAPDSS: disable VT switch fbdev: sh_mobile_lcdc: Fix destruction of uninitialized mutex video: fbdev: sh_mobile_lcdcfb: Fix ROP3 sysfs attribute parsing fbdev: pm3fb: cleanup some confusing indenting hyperv: hyperv_fb: match wait_for_completion_timeout return type video: fbdev: use msecs_to_jiffies for time conversions fbdev: via/via_clock: fix sparse warning video: fbdev: make of_device_id array const fbdev: sm501fb: use memset_io OMAPDSS: workaround for MFLAG + NV12 issue OMAPDSS: Add support for MFLAG OMAPDSS: setup default fifo thresholds OMAPDSS: DISPC: lock access to DISPC_CONTROL & DISPC_CONFIG OMAPDSS: DISPC: fix div by zero issue in overlay scaling OMAPDSS: DISPC: change sync_pclk_edge default value OMAPDSS: change signal_level & signal_edge enum values OMAPDSS: DISPC: explicit handling for sync and de levels OMAPDSS: DISPC: remove OMAPDSS_DRIVE_SIG_OPPOSITE_EDGES ... 
Pull fbdev updates from Tomi Valkeinen:
 "Small fixes and improvements to various fbdev drivers"

* tag 'fbdev-4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: (24 commits)
  omapdss: extend pm notifier to handle hibernation
  OMAPDSS: Correct video ports description file path in DT binding doc
  OMAPDSS: disable VT switch
  fbdev: sh_mobile_lcdc: Fix destruction of uninitialized mutex
  video: fbdev: sh_mobile_lcdcfb: Fix ROP3 sysfs attribute parsing
  fbdev: pm3fb: cleanup some confusing indenting
  hyperv: hyperv_fb: match wait_for_completion_timeout return type
  video: fbdev: use msecs_to_jiffies for time conversions
  fbdev: via/via_clock: fix sparse warning
  video: fbdev: make of_device_id array const
  fbdev: sm501fb: use memset_io
  OMAPDSS: workaround for MFLAG + NV12 issue
  OMAPDSS: Add support for MFLAG
  OMAPDSS: setup default fifo thresholds
  OMAPDSS: DISPC: lock access to DISPC_CONTROL & DISPC_CONFIG
  OMAPDSS: DISPC: fix div by zero issue in overlay scaling
  OMAPDSS: DISPC: change sync_pclk_edge default value
  OMAPDSS: change signal_level & signal_edge enum values
  OMAPDSS: DISPC: explicit handling for sync and de levels
  OMAPDSS: DISPC: remove OMAPDSS_DRIVE_SIG_OPPOSITE_EDGES
  ...
Merge omapdss topic branch for fbdev 4.1 2015-04-20T09:09:31+00:00 Tomi Valkeinen tomi.valkeinen@ti.com 2015-04-20T09:09:31+00:00 6b75b54c841a18ef114704aa5cf2cdf43487b0ae