linux.git/drivers/video/console, branch v2.6.31

fbcon: don't use vc_resize() on initialization

2009-08-07T17:39:56+00:00

Catalin and kmemleak spotted a leak of a VC screen buffer in
vc_allocate() due to the following chain of events:

	vc_allocate()
	  visual_init(init=1)
	    vc->vc_sw->con_init(init=1)
              fbcon_init()
	        vc_resize()
	          vc->screen_buf = kmalloc()
	  vc->screen_buf = kmalloc()

The common way for the VC drivers is to set the screen dimension
parameters manually in the init case and only call vc_resize() for
!init - which allocates a screen buffer according to the new
dimensions.

fbcon instead would do vc_resize() unconditionally and afterwards set
the dimensions manually (again) for !init - i.e. completely upside
down.  The vc_resize() allocated buffer would then get lost by
vc_allocate() allocating a fresh one.

Use vc_resize() only for actual resizing to close the leak.

Set the dimensions manually only in initialization mode to remove the
redundant setting in resize mode.

The kmemleak trace from Catalin:

unreferenced object 0xde158000 (size 12288):
  comm "Xorg", pid 1439, jiffies 4294961016
  hex dump (first 32 bytes):
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
  backtrace:
    [] __save_stack_trace+0x17/0x1c
    [] create_object+0xcd/0x188
    [] kmemleak_alloc+0x1b/0x3c
    [] __kmalloc+0xdb/0xe8
    [] vc_do_resize+0x73/0x1e0
    [] vc_resize+0x15/0x18
    [] fbcon_init+0x1f9/0x2b8
    [] visual_init+0x9f/0xdc
    [] vc_allocate+0x7f/0xfc
    [] con_open+0x17/0x80
    [] tty_open+0x1f7/0x2e4
    [] chrdev_open+0x101/0x118
    [] __dentry_open+0x105/0x1cc
    [] nameidata_to_filp+0x2d/0x38
    [] do_filp_open+0x2c1/0x54c
    [] do_sys_open+0x3b/0xb4

Reported-by: Catalin Marinas 
Signed-off-by: Johannes Weiner 
Tested-by: Catalin Marinas 
Cc: Pekka Enberg 
Cc: Krzysztof Helt 
Tested-by: Dave Young 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbcon: fix rotate upside down crash

2009-08-07T17:39:55+00:00

Fix the rotate_ud() function not to crash in case of a font which has not
a width of multiple by 8: The inner loop of the font pixel copy should not
access a bit outside the font memory area.  Subtract the shift offset from
the font width will prevent this.

Signed-off-by: Stefani Seibold 
Cc: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

parisc: sticore.c - check return values

2009-08-02T13:26:51+00:00

Signed-off-by: Helge Deller

vgacon: use slab allocator instead of the bootmem allocator

2009-06-11T16:33:34+00:00

Slab is initialized before the console subsystem so use the slab allocator in
vgacon_scrollback_startup().

Signed-off-by: Pekka Enberg

vgacon: return the upper half of 512 character fonts

2009-05-02T22:36:10+00:00

Uwe Geuder noted that he gets random bitmaps on a text console if he tried
to type extended characters (like the e acute).  For him everything above
unicode 0xa0 was corrupted.

After some digging there seems to be a little culprit in vgacon since the
beginning of ages (well git).  The function vgacon_font_get will store the
number of characters correctly in font->charcount but then calls to
vgacon_do_font_op(..., 0, 0).  Which means only the lower 256 characters
are actually stored to the fontdata.  The rest is left untouched.  So the
next time that saved data is used, the garbled font appears.  This happens
on every switch between text consoles.

Addresses https://bugs.launchpad.net/ubuntu/+source/linux/+bug/355057

Signed-off-by: Stefan Bader 
Tested-by: Uwe Geuder 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbdev: fix info->lock deadlock in fbcon_event_notify()

2009-04-13T22:04:28+00:00

fb_notifier_call_chain() is called with info->lock held, i.e.  in
do_fb_ioctl() => FBIOPUT_VSCREENINFO => fb_set_var() and the some
notifier callbacks, like fbcon_event_notify(), try to re-acquire
info->lock again.

Remove the lock/unlock_fb_info() in all the framebuffer notifier
callbacks' and be sure to always call fb_notifier_call_chain() with
info->lock held.

Reported-by: Pavel Roskin 
Reported-by: Eric Miao 
Signed-off-by: Andrea Righi 
Cc: Stefan Richter 
Cc: Krzysztof Helt 
Cc: Geert Uytterhoeven 
Cc: "Rafael J. Wysocki" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbmem: fix fb_info->lock and mm->mmap_sem circular locking dependency

2009-04-01T15:59:29+00:00

Fix a circular locking dependency in the frame buffer console driver
pushing down the mutex fb_info->lock.

Circular locking dependecies occur calling the blocking
fb_notifier_call_chain() with fb_info->lock held.  Notifier callbacks can
try to acquire mm->mmap_sem, while fb_mmap() acquires the locks in the
reverse order mm->mmap_sem => fb_info->lock.

Tested-by: Andrey Borzenkov 
Signed-off-by: Andrea Righi 
Cc: Geert Uytterhoeven 
Cc: Krzysztof Helt 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbdev: Kill Atari vblank cursor blinking

2009-01-12T19:56:43+00:00

Kill the last remaining vblank cursor blinking user

Signed-off-by: Geert Uytterhoeven

trivial: fix then -> than typos in comments and documentation

2009-01-06T10:28:06+00:00

- (better, more, bigger ...) then -> (...) than

Signed-off-by: Frederik Schwarzer 
Signed-off-by: Jiri Kosina

Merge branch 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

2008-12-31T01:25:49+00:00

* 'drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (37 commits)
  drm/i915: fix modeset devname allocation + agp init return check.
  drm/i915: Remove redundant test in error path.
  drm: Add a debug node for vblank state.
  drm: Avoid use-before-null-test on dev in drm_cleanup().
  drm/i915: Don't print to dmesg when taking signal during object_pin.
  drm: pin new and unpin old buffer when setting a mode.
  drm/i915: un-EXPORT and make 'intelfb_panic' static
  drm/i915: Delete unused, pointless i915_driver_firstopen.
  drm/i915: fix sparse warnings: returning void-valued expression
  drm/i915: fix sparse warnings: move 'extern' decls to header file
  drm/i915: fix sparse warnings: make symbols static
  drm/i915: fix sparse warnings: declare one-bit bitfield as unsigned
  drm/i915: Don't double-unpin buffers if we take a signal in evict_everything().
  drm/i915: Fix fbcon setup to align display pitch to 64b.
  drm/i915: Add missing userland definitions for gem init/execbuffer.
  i915/drm: provide compat defines for userspace for certain struct members.
  drm: drop DRM_IOCTL_MODE_REPLACEFB, add+remove works just as well.
  drm: sanitise drm modesetting API + remove unused hotplug
  drm: fix allowing master ioctls on non-master fds.
  drm/radeon: use locked rmmap to remove sarea mapping.
  ...