linux-stable.git/drivers/video, branch v5.4.244

fbdev: udlfb: Fix endpoint check

2023-05-30T11:44:09+00:00

commit ed9de4ed39875706607fb08118a58344ae6c5f42 upstream.

The syzbot fuzzer detected a problem in the udlfb driver, caused by an
endpoint not having the expected type:

usb 1-1: Read EDID byte 0 failed: -71
usb 1-1: Unable to get valid EDID from device/display
------------[ cut here ]------------
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880
drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted
6.4.0-rc1-syzkaller-00016-ga4422ff22142 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
04/28/2023
Workqueue: usb_hub_wq hub_event
RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504
...
Call Trace:
 
 dlfb_submit_urb+0x92/0x180 drivers/video/fbdev/udlfb.c:1980
 dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315
 dlfb_ops_set_par+0x2a7/0x8d0 drivers/video/fbdev/udlfb.c:1111
 dlfb_usb_probe+0x149a/0x2710 drivers/video/fbdev/udlfb.c:1743

The current approach for this issue failed to catch the problem
because it only checks for the existence of a bulk-OUT endpoint; it
doesn't check whether this endpoint is the one that the driver will
actually use.

We can fix the problem by instead checking that the endpoint used by
the driver does exist and is bulk-OUT.

Reported-and-tested-by: syzbot+0e22d63dcebb802b9bc8@syzkaller.appspotmail.com
Signed-off-by: Alan Stern 
CC: Pavel Skripkin 
Fixes: aaf7dbe07385 ("video: fbdev: udlfb: properly check endpoint type")
Signed-off-by: Helge Deller 
Signed-off-by: Greg Kroah-Hartman

fbdev: au1200fb: Fix potential divide by zero

2023-04-05T09:16:43+00:00

[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ]

var->pixclock can be assigned to zero by user. Without
proper check, divide by zero would occur when invoking
macro PICOS2KHZ in au1200fb_fb_check_var.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: lxfb: Fix potential divide by zero

2023-04-05T09:16:43+00:00

[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ]

var->pixclock can be assigned to zero by user. Without proper
check, divide by zero would occur in lx_set_clock.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: intelfb: Fix potential divide by zero

2023-04-05T09:16:42+00:00

[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ]

Variable var->pixclock is controlled by user and can be assigned
to zero. Without proper check, divide by zero would occur in
intelfbhw_validate_mode and intelfbhw_mode_to_hw.

Error out if var->pixclock is zero.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: nvidia: Fix potential divide by zero

2023-04-05T09:16:42+00:00

[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ]

variable var->pixclock can be set by user. In case it
equals to zero, divide by zero would occur in nvidiafb_set_par.

Similar crashes have happened in other fbdev drivers. There
is no check and modification on var->pixclock along the call
chain to nvidia_check_var and nvidiafb_set_par. We believe it
could also be triggered in driver nvidia from user site.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: tgafb: Fix potential divide by zero

2023-04-05T09:16:42+00:00

[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ]

fb_set_var would by called when user invokes ioctl with cmd
FBIOPUT_VSCREENINFO. User-provided data would finally reach
tgafb_check_var. In case var->pixclock is assigned to zero,
divide by zero would occur when checking whether reciprocal
of var->pixclock is too high.

Similar crashes have happened in other fbdev drivers. There
is no check and modification on var->pixclock along the call
chain to tgafb_check_var. We believe it could also be triggered
in driver tgafb from user site.

Signed-off-by: Wei Chen 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks

2023-03-22T12:28:09+00:00

commit 203873a535d627c668f293be0cb73e26c30f9cc7 upstream.

Find a valid modeline depending on the machine graphic card
configuration and add the fb_check_var() function to validate
Xorg provided graphics settings.

Signed-off-by: Helge Deller 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

fbdev: smscufx: fix error handling code in ufx_usb_probe

2023-02-22T11:50:29+00:00

commit b76449ee75e21acfe9fa4c653d8598f191ed7d68 upstream.

The current error handling code in ufx_usb_probe have many unmatching
issues, e.g., missing ufx_free_usb_list, destroy_modedb label should
only include framebuffer_release, fb_dealloc_cmap only matches
fb_alloc_cmap.

My local syzkaller reports a memory leak bug:

memory leak in ufx_usb_probe

BUG: memory leak
unreferenced object 0xffff88802f879580 (size 128):
  comm "kworker/0:7", pid 17416, jiffies 4295067474 (age 46.710s)
  hex dump (first 32 bytes):
    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............
    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................
  backtrace:
    [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045
    [] kmalloc include/linux/slab.h:553 [inline]
    [] kzalloc include/linux/slab.h:689 [inline]
    [] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]
    [] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655
    [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [] call_driver_probe drivers/base/dd.c:560 [inline]
    [] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778
    [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808
    [] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936
    [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008
    [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [] device_add+0x642/0xdc0 drivers/base/core.c:3517
    [] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170
    [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
    [] call_driver_probe drivers/base/dd.c:560 [inline]
    [] really_probe+0x12d/0x390 drivers/base/dd.c:639
    [] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778

Fix this bug by rewriting the error handling code in ufx_usb_probe.

Reported-by: syzkaller 
Tested-by: Dongliang Mu 
Signed-off-by: Dongliang Mu 
Signed-off-by: Helge Deller 
Signed-off-by: Greg Kroah-Hartman

fbcon: Check font dimension limits

2023-02-22T11:50:27+00:00

commit 2b09d5d364986f724f17001ccfe4126b9b43a0be upstream.

blit_x and blit_y are u32, so fbcon currently cannot support fonts
larger than 32x32.

The 32x32 case also needs shifting an unsigned int, to properly set bit
31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font",
as reported on:

http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB9830.namprd07.prod.outlook.com
Kernel Branch: 6.2.0-rc5-next-20230124
Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=sharing
Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=sharing

Reported-by: Sanan Hasanov 
Signed-off-by: Samuel Thibault 
Fixes: 2d2699d98492 ("fbcon: font setting should check limitation of driver")
Cc: stable@vger.kernel.org
Tested-by: Miko Larsson 
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Helge Deller 
Signed-off-by: Greg Kroah-Hartman

fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()

2023-01-18T10:41:27+00:00

[ Upstream commit a94371040712031ba129c7e9d8ff04a06a2f8207 ]

If an error occurs after a successful uvesafb_init_mtrr() call, it must be
undone by a corresponding arch_phys_wc_del() call, as already done in the
remove function.

This has been added in the remove function in commit 63e28a7a5ffc
("uvesafb: Clean up MTRR code")

Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Signed-off-by: Christophe JAILLET 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin