linux.git/drivers/video/fbdev, branch v6.8-rc7

fbcon: always restore the old font data in fbcon_do_set_font()

2024-02-26T15:47:02+00:00

Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when
vc_resize() failed) started restoring old font data upon failure (of
vc_resize()). But it performs so only for user fonts. It means that the
"system"/internal fonts are not restored at all. So in result, the very
first call to fbcon_do_set_font() performs no restore at all upon
failing vc_resize().

This can be reproduced by Syzkaller to crash the system on the next
invocation of font_get(). It's rather hard to hit the allocation failure
in vc_resize() on the first font_set(), but not impossible. Esp. if
fault injection is used to aid the execution/failure. It was
demonstrated by Sirius:
  BUG: unable to handle page fault for address: fffffffffffffff8
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD cb7b067 P4D cb7b067 PUD cb7d067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP KASAN
  CPU: 1 PID: 8007 Comm: poc Not tainted 6.7.0-g9d1694dc91ce #20
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
  RIP: 0010:fbcon_get_font+0x229/0x800 drivers/video/fbdev/core/fbcon.c:2286
  Call Trace:
   
   con_font_get drivers/tty/vt/vt.c:4558 [inline]
   con_font_op+0x1fc/0xf20 drivers/tty/vt/vt.c:4673
   vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline]
   vt_ioctl+0x632/0x2ec0 drivers/tty/vt/vt_ioctl.c:752
   tty_ioctl+0x6f8/0x1570 drivers/tty/tty_io.c:2803
   vfs_ioctl fs/ioctl.c:51 [inline]
  ...

So restore the font data in any case, not only for user fonts. Note the
later 'if' is now protected by 'old_userfont' and not 'old_data' as the
latter is always set now. (And it is supposed to be non-NULL. Otherwise
we would see the bug above again.)

Signed-off-by: Jiri Slaby (SUSE) 
Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
Reported-and-tested-by: Ubisectech Sirius 
Cc: Ubisectech Sirius 
Cc: Daniel Vetter 
Cc: Helge Deller 
Cc: linux-fbdev@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Daniel Vetter 
Link: https://patchwork.freedesktop.org/patch/msgid/20240208114411.14604-1-jirislaby@kernel.org

fbdev: stifb: Fix crash in stifb_blank()

2024-01-23T08:13:24+00:00

Avoid a kernel crash in stifb by providing the correct pointer to the fb_info
struct. Prior to commit e2e0b838a184 ("video/sticore: Remove info field from
STI struct") the fb_info struct was at the beginning of the fb struct.

Fixes: e2e0b838a184 ("video/sticore: Remove info field from STI struct")
Signed-off-by: Helge Deller 
Cc: Thomas Zimmermann

fbcon: Fix incorrect printed function name in fbcon_prepare_logo()

2024-01-22T21:41:15+00:00

If the boot logo does not fit, a message is printed, including a wrong
function name prefix.  Instead of correcting the function name (or using
__func__), just use "fbcon", like is done in several other messages.

While at it, modernize the call by switching to pr_info().

Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Helge Deller

fbdev: sis: Error out if pixclock equals zero

2024-01-21T08:00:14+00:00

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of pixclock,
it may cause divide-by-zero error.

In sisfb_check_var(), var->pixclock is used as a divisor to caculate
drate before it is checked against zero. Fix this by checking it
at the beginning.

This is similar to CVE-2022-3061 in i740fb which was fixed by
commit 15cf0b8.

Signed-off-by: Fullway Wang 
Signed-off-by: Helge Deller

fbdev: savage: Error out if pixclock equals zero

2024-01-21T08:00:14+00:00

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of pixclock,
it may cause divide-by-zero error.

Although pixclock is checked in savagefb_decode_var(), but it is not
checked properly in savagefb_probe(). Fix this by checking whether
pixclock is zero in the function savagefb_check_var() before
info->var.pixclock is used as the divisor.

This is similar to CVE-2022-3061 in i740fb which was fixed by
commit 15cf0b8.

Signed-off-by: Fullway Wang 
Signed-off-by: Helge Deller

fbdev: vt8500lcdfb: Remove unnecessary print function dev_err()

2024-01-21T07:49:56+00:00

The print function dev_err() is redundant because platform_get_irq()
already prints an error.

Reported-by: Abaci Robot 
Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=7824
Signed-off-by: Jiapeng Chong 
Signed-off-by: Helge Deller

Merge tag 'i2c-for-6.8-rc1-rebased' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

2024-01-19T01:29:01+00:00

Pull i2c updates from Wolfram Sang:
 "This removes the currently unused CLASS_DDC support (controllers set
  the flag, but there is no client to use it).

  Also, CLASS_SPD support gets simplified to prepare removal in the
  future. Class based instantiation is not recommended these days
  anyhow.

  Furthermore, I2C core now creates a debugfs directory per I2C adapter.
  Current bus driver users were converted to use it.

  Finally, quite some driver updates. Standing out are patches for the
  wmt-driver which is refactored to support more variants.

  This is the rebased pull request where a large series for the
  designware driver was dropped"

* tag 'i2c-for-6.8-rc1-rebased' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (38 commits)
  MAINTAINERS: use proper email for my I2C work
  i2c: stm32f7: add support for stm32mp25 soc
  i2c: stm32f7: perform I2C_ISR read once at beginning of event isr
  dt-bindings: i2c: document st,stm32mp25-i2c compatible
  i2c: stm32f7: simplify status messages in case of errors
  i2c: stm32f7: perform most of irq job in threaded handler
  i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
  i2c: i801: Add lis3lv02d for Dell XPS 15 7590
  i2c: i801: Add lis3lv02d for Dell Precision 3540
  i2c: wmt: Reduce redundant: REG_CR setting
  i2c: wmt: Reduce redundant: function parameter
  i2c: wmt: Reduce redundant: clock mode setting
  i2c: wmt: Reduce redundant: wait event complete
  i2c: wmt: Reduce redundant: bus busy check
  i2c: mux: reg: Remove class-based device auto-detection support
  i2c: make i2c_bus_type const
  dt-bindings: at24: add ROHM BR24G04
  eeprom: at24: use of_match_ptr()
  i2c: cpm: Remove linux,i2c-index conversion from be32
  i2c: imx: Make SDA actually optional for bus recovering
  ...

fbdev: remove I2C_CLASS_DDC support

2024-01-18T20:10:41+00:00

After removal of the legacy EEPROM driver and I2C_CLASS_DDC support in
olpc_dcon there's no i2c client driver left supporting I2C_CLASS_DDC.
Class-based device auto-detection is a legacy mechanism and shouldn't
be used in new code. So we can remove this class completely now.

Acked-by: Helge Deller 
Acked-by: Thomas Zimmermann 
Signed-off-by: Heiner Kallweit 
Signed-off-by: Wolfram Sang

Merge tag 'pwm/for-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm

2024-01-12T22:59:50+00:00

Pull pwm updates from Thierry Reding:
 "This contains a bunch of cleanups and simplifications across the
  board, as well as a number of small fixes.

  Perhaps the most notable change here is the addition of an API that
  allows PWMs to be used in atomic contexts, which is useful when time-
  critical operations are involved, such as using a PWM to generate IR
  signals.

  Finally, I have decided to step down as PWM subsystem maintainer. Due
  to other responsibilities I have lately not been able to find the time
  that the subsystem deserves and Uwe, who has been helping out a lot
  for the past few years and has many things planned for the future, has
  kindly volunteered to take over. I have no doubt that he will be a
  suitable replacement"

* tag 'pwm/for-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (44 commits)
  MAINTAINERS: pwm: Thierry steps down, Uwe takes over
  pwm: linux/pwm.h: fix Excess kernel-doc description warning
  pwm: Add pwm_apply_state() compatibility stub
  pwm: cros-ec: Drop documentation for dropped struct member
  pwm: Drop two unused API functions
  pwm: lpc18xx-sct: Don't modify the cached period of other PWM outputs
  pwm: meson: Simplify using dev_err_probe()
  pwm: stmpe: Silence duplicate error messages
  pwm: Reduce number of pointer dereferences in pwm_device_request()
  pwm: crc: Use consistent variable naming for driver data
  pwm: omap-dmtimer: Drop locking
  dt-bindings: pwm: ti,pwm-omap-dmtimer: Update binding for yaml
  media: pwm-ir-tx: Trigger edges from hrtimer interrupt context
  pwm: bcm2835: Allow PWM driver to be used in atomic context
  pwm: Make it possible to apply PWM changes in atomic context
  pwm: renesas: Remove unused include
  pwm: Replace ENOTSUPP with EOPNOTSUPP
  pwm: Rename pwm_apply_state() to pwm_apply_might_sleep()
  pwm: Stop referencing pwm->chip
  pwm: Update kernel doc for struct pwm_chip
  ...

Merge tag 'fbdev-for-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

2024-01-12T22:38:08+00:00

Pull fbdev updates from Helge Deller:
 "Three fbdev drivers (~8500 lines of code) removed. The Carillo Ranch
  fbdev driver is for an Intel product which was never shipped, and for
  the intelfb and the amba-clcd drivers the drm drivers can be used
  instead.

  The other code changes are minor: some fb_deferred_io flushing fixes,
  imxfb margin fixes and stifb cleanups.

  Summary:
   - Remove intelfb fbdev driver (Thomas Zimmermann)
   - Remove amba-clcd fbdev driver (Linus Walleij)
   - Remove vmlfb Carillo Ranch fbdev driver (Matthew Wilcox)
   - fb_deferred_io flushing fixes (Nam Cao)
   - imxfb code fixes and cleanups (Dario Binacchi)
   - stifb primary screen detection cleanups (Thomas Zimmermann)"

* tag 'fbdev-for-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (28 commits)
  fbdev/intelfb: Remove driver
  fbdev/hyperv_fb: Do not clear global screen_info
  firmware/sysfb: Clear screen_info state after consuming it
  fbdev/hyperv_fb: Remove firmware framebuffers with aperture helpers
  drm/hyperv: Remove firmware framebuffers with aperture helper
  fbdev/sis: Remove dependency on screen_info
  video/logo: use %u format specifier for unsigned int values
  video/sticore: Remove info field from STI struct
  arch/parisc: Detect primary video device from device instance
  fbdev/stifb: Allocate fb_info instance with framebuffer_alloc()
  video/sticore: Store ROM device in STI struct
  fbdev: flush deferred IO before closing
  fbdev: flush deferred work in fb_deferred_io_fsync()
  fbdev: amba-clcd: Delete the old CLCD driver
  fbdev: Remove support for Carillo Ranch driver
  fbdev: hgafb: fix kernel-doc comments
  fbdev: mmp: Fix typo and wording in code comment
  fbdev: fsl-diu-fb: Fix sparse warning due to virt_to_phys() prototype change
  fbdev: imxfb: add '*/' on a separate line in block comment
  fbdev: imxfb: use __func__ for function name
  ...