linux-stable.git/drivers/video, branch v5.0.9

backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state

2019-04-05T20:34:46+00:00

[ Upstream commit cec2b18832e26bc866bef2be22eff4e25bbc4034 ]

gpiod_get_value() gives out a warning if access to the underlying gpiochip
requires sleeping, which is common for I2C based chips:

    WARNING: CPU: 0 PID: 77 at drivers/gpio/gpiolib.c:2500 gpiod_get_value+0xd0/0x100
    Modules linked in:
    CPU: 0 PID: 77 Comm: kworker/0:2 Not tainted 4.14.0-rc3-00589-gf32897915d48-dirty #90
    Hardware name: Allwinner sun4i/sun5i Families
    Workqueue: events deferred_probe_work_func
    [] (unwind_backtrace) from [] (show_stack+0x10/0x14)
    [] (show_stack) from [] (dump_stack+0x88/0x9c)
    [] (dump_stack) from [] (__warn+0xe8/0x100)
    [] (__warn) from [] (warn_slowpath_null+0x20/0x28)
    [] (warn_slowpath_null) from [] (gpiod_get_value+0xd0/0x100)
    [] (gpiod_get_value) from [] (pwm_backlight_probe+0x238/0x508)
    [] (pwm_backlight_probe) from [] (platform_drv_probe+0x50/0xac)
    [] (platform_drv_probe) from [] (driver_probe_device+0x238/0x2e8)
    [] (driver_probe_device) from [] (bus_for_each_drv+0x44/0x94)
    [] (bus_for_each_drv) from [] (__device_attach+0xb0/0x114)
    [] (__device_attach) from [] (bus_probe_device+0x84/0x8c)
    [] (bus_probe_device) from [] (deferred_probe_work_func+0x50/0x14c)
    [] (deferred_probe_work_func) from [] (process_one_work+0x1ec/0x414)
    [] (process_one_work) from [] (worker_thread+0x2b0/0x5a0)
    [] (worker_thread) from [] (kthread+0x14c/0x154)
    [] (kthread) from [] (ret_from_fork+0x14/0x24)

This was missed in commit 0c9501f823a4 ("backlight: pwm_bl: Handle gpio
that can sleep"). The code was then moved to a separate function in
commit 7613c922315e ("backlight: pwm_bl: Move the checks for initial power
state to a separate function").

The only usage of gpiod_get_value() is during the probe stage, which is
safe to sleep in. Switch to gpiod_get_value_cansleep().

Fixes: 0c9501f823a4 ("backlight: pwm_bl: Handle gpio that can sleep")
Signed-off-by: Chen-Yu Tsai 
Acked-by: Maxime Ripard 
Acked-by: Daniel Thompson 
Signed-off-by: Lee Jones 
Signed-off-by: Sasha Levin

fbdev: fbmem: fix memory access if logo is bigger than the screen

2019-04-05T20:34:41+00:00

[ Upstream commit a5399db139cb3ad9b8502d8b1bd02da9ce0b9df0 ]

There is no clipping on the x or y axis for logos larger that the framebuffer
size. Therefore: a logo bigger than screen size leads to invalid memory access:

[    1.254664] Backtrace:
[    1.254728] [] (cfb_imageblit) from [] (fb_show_logo+0x620/0x684)
[    1.254763]  r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4
[    1.254774]  r4:c6a3e800
[    1.254810] [] (fb_show_logo) from [] (fbcon_switch+0x3fc/0x46c)
[    1.254842]  r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800
[    1.254852]  r4:c6808c00
[    1.254889] [] (fbcon_switch) from [] (redraw_screen+0xf0/0x1e8)
[    1.254918]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080
[    1.254928]  r4:c6808c00
[    1.254961] [] (redraw_screen) from [] (do_bind_con_driver+0x194/0x2e4)
[    1.254991]  r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0

So prevent displaying a logo bigger than screen size and avoid invalid
memory access.

Signed-off-by: Manfred Schlaegl 
Signed-off-by: Martin Kepplinger 
Cc: Daniel Vetter 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin

Merge tag 'tty-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2019-01-25T22:58:40+00:00

Pull tty/serial driver fixes from Greg KH:
 "Here are a number of small tty core and serial driver fixes for
  5.0-rc4 to resolve some reported issues.

  Nothing major, the small serial driver fixes, a tty core fixup for a
  crash that was reported, and some good vt fixes from Nicolas Pitre as
  he seems to be auditing that chunk of code a lot lately.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'tty-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
  tty: serial: qcom_geni_serial: Allow mctrl when flow control is disabled
  tty: Handle problem if line discipline does not have receive_buf
  vgacon: unconfuse vc_origin when using soft scrollback
  vt: invoke notifier on screen size change
  vt: always call notifier with the console lock held
  vt: make vt_console_print() compatible with the unicode screen buffer
  tty/n_hdlc: fix __might_sleep warning
  serial: 8250: Fix serial8250 initialization crash
  uart: Fix crash in uart_write and uart_put_char

Merge tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux

2019-01-18T17:43:05+00:00

Pull fbdev fixes from Bartlomiej Zolnierkiewicz:

 - fix stack memory leak in omap2fb driver (Vlad Tsyrklevich)

 - fix OF node name handling v4.20 regression in offb driver (Rob
   Herring)

 - convert CONFIG_FB_LOGO_CENTER config option added in v5.0-rc1 into a
   kernel parameter (Peter Rosin)

* tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux:
  fbdev: fbmem: convert CONFIG_FB_LOGO_CENTER into a cmd line option
  fbdev: offb: Fix OF node name handling
  omap2fb: Fix stack memory disclosure

vgacon: unconfuse vc_origin when using soft scrollback

2019-01-18T12:45:22+00:00

When CONFIG_VGACON_SOFT_SCROLLBACK is selected, the VGA display memory
index and vc_visible_origin don't change when scrollback is activated.
The actual screen content is saved away and the scrollbackdata is copied
over it. However the vt code, and /dev/vcs devices in particular, still
expect vc_origin to always point at the actual screen content not the
displayed scrollback content.

So adjust vc_origin to point at the saved screen content when scrollback
is active and set it back to vc_visible_origin when restoring the screen.

This fixes /dev/vcsa that return scrollback content when they
shouldn't (onli /dev/vcsa without a number should), and also fixes
/dev/vcsu that should return scrollback content when scrollback is
active but currently doesn't.

An unnecessary call to vga_set_mem_top() is also removed.

Signed-off-by: Nicolas Pitre 
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Greg Kroah-Hartman

fbdev: fbmem: convert CONFIG_FB_LOGO_CENTER into a cmd line option

2019-01-16T16:42:35+00:00

A command line option is much more flexible than a config option and
the supporting code is small. Gets rid of #ifdefs in the code too...

Suggested-by: Geert Uytterhoeven 
Cc: Jonathan Corbet 
Signed-off-by: Peter Rosin 
Signed-off-by: Bartlomiej Zolnierkiewicz

Merge tag 'backlight-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight

2019-01-14T18:21:10+00:00

Pull backlight updates from Lee Jones:
 "Fix-ups:
   - Use new of_node_name_eq() API call

  Bug Fixes:
   - Internally track 'enabled' state in pwm_bl
   - Fix auto-generated pwm_bl brightness tables parsed by DT

* tag 'backlight-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: 88pm860x_bl: Use of_node_name_eq for node name comparisons
  backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables
  backlight: pwm_bl: Re-add driver internal enabled tracking

fbdev: offb: Fix OF node name handling

2019-01-11T13:34:39+00:00

Commit 5c63e407aaab ("fbdev: Convert to using %pOFn instead of
device_node.name") changed how the OF FB driver handles the OF node
name. This missed the case where the node name is passed to
offb_init_palette_hacks(). This results in a NULL ptr dereference
in strncmp and breaks any system except ones using bootx with no display
node.

Fix this by making offb_init_palette_hacks() use the OF node pointer and
use of_node_name_prefix() helper function instead for node name
comparisons. This helps in moving all OF node name accesses to helper
functions in preparation to remove struct device_node.name pointer.

Fixes: 5c63e407aaab ("fbdev: Convert to using %pOFn instead of device_node.name")
Reported-by: Mathieu Malaterre 
Tested-by: Mathieu Malaterre 
Cc: stable@vger.kernel.org # v4.19+
Cc: Elimar Riesebieter 
Signed-off-by: Rob Herring 
Signed-off-by: Bartlomiej Zolnierkiewicz

omap2fb: Fix stack memory disclosure

2019-01-11T13:34:38+00:00

Using [1] for static analysis I found that the OMAPFB_QUERY_PLANE,
OMAPFB_GET_COLOR_KEY, OMAPFB_GET_DISPLAY_INFO, and OMAPFB_GET_VRAM_INFO
cases could all leak uninitialized stack memory--either due to
uninitialized padding or 'reserved' fields.

Fix them by clearing the shared union used to store copied out data.

[1] https://github.com/vlad902/kernel-uninitialized-memory-checker

Signed-off-by: Vlad Tsyrklevich 
Reviewed-by: Kees Cook 
Fixes: b39a982ddecf ("OMAP: DSS2: omapfb driver")
Cc: security@kernel.org
[b.zolnierkie: prefix patch subject with "omap2fb: "]
Signed-off-by: Bartlomiej Zolnierkiewicz

cross-tree: phase out dma_zalloc_coherent()

2019-01-08T12:58:37+00:00

We already need to zero out memory for dma_alloc_coherent(), as such
using dma_zalloc_coherent() is superflous. Phase it out.

This change was generated with the following Coccinelle SmPL patch:

@ replace_dma_zalloc_coherent @
expression dev, size, data, handle, flags;
@@

-dma_zalloc_coherent(dev, size, handle, flags)
+dma_alloc_coherent(dev, size, handle, flags)

Suggested-by: Christoph Hellwig 
Signed-off-by: Luis Chamberlain 
[hch: re-ran the script on the latest tree]
Signed-off-by: Christoph Hellwig