kernel/git/stable/linux.git/drivers/video/fbdev, branch linux-6.7.y

fbcon: always restore the old font data in fbcon_do_set_font()

2024-03-06T14:53:53+00:00

[ Upstream commit 00d6a284fcf3fad1b7e1b5bc3cd87cbfb60ce03f ] Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when vc_resize() failed) started restoring old font data upon failure (of vc_resize()). But it performs so only for user fonts. It means that the "system"/internal fonts are not restored at all. So in result, the very first call to fbcon_do_set_font() performs no restore at all upon failing vc_resize(). This can be reproduced by Syzkaller to crash the system on the next invocation of font_get(). It's rather hard to hit the allocation failure in vc_resize() on the first font_set(), but not impossible. Esp. if fault injection is used to aid the execution/failure. It was demonstrated by Sirius: BUG: unable to handle page fault for address: fffffffffffffff8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD cb7b067 P4D cb7b067 PUD cb7d067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8007 Comm: poc Not tainted 6.7.0-g9d1694dc91ce #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:fbcon_get_font+0x229/0x800 drivers/video/fbdev/core/fbcon.c:2286 Call Trace: con_font_get drivers/tty/vt/vt.c:4558 [inline] con_font_op+0x1fc/0xf20 drivers/tty/vt/vt.c:4673 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline] vt_ioctl+0x632/0x2ec0 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0x6f8/0x1570 drivers/tty/tty_io.c:2803 vfs_ioctl fs/ioctl.c:51 [inline] ... So restore the font data in any case, not only for user fonts. Note the later 'if' is now protected by 'old_userfont' and not 'old_data' as the latter is always set now. (And it is supposed to be non-NULL. Otherwise we would see the bug above again.) Signed-off-by: Jiri Slaby (SUSE) Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed") Reported-and-tested-by: Ubisectech Sirius Cc: Ubisectech Sirius Cc: Daniel Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20240208114411.14604-1-jirislaby@kernel.org Signed-off-by: Sasha Levin

fbdev: sis: Error out if pixclock equals zero

2024-03-01T12:41:34+00:00

[ Upstream commit e421946be7d9bf545147bea8419ef8239cb7ca52 ] The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. In sisfb_check_var(), var->pixclock is used as a divisor to caculate drate before it is checked against zero. Fix this by checking it at the beginning. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

fbdev: savage: Error out if pixclock equals zero

2024-03-01T12:41:34+00:00

[ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

fbdev: flush deferred IO before closing

2024-01-25T23:45:13+00:00

commit 33cd6ea9c0673517cdb06ad5c915c6f22e9615fc upstream. When framebuffer gets closed, the queued deferred IO gets cancelled. This can cause some last display data to vanish. This is problematic for users who send a still image to the framebuffer, then close the file: the image may never appear. To ensure none of display data get lost, flush the queued deferred IO first before closing. Another possible solution is to delete the cancel_delayed_work_sync() instead. The difference is that the display may appear some time after closing. However, the clearing of page mapping after this needs to be removed too, because the page mapping is used by the deferred work. It is not completely obvious whether it is okay to not clear the page mapping. For a patch intended for stable trees, go with the simple and obvious solution. Fixes: 60b59beafba8 ("fbdev: mm: Deferred IO support") Cc: stable@vger.kernel.org Signed-off-by: Nam Cao Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman

fbdev: flush deferred work in fb_deferred_io_fsync()

2024-01-25T23:45:13+00:00

commit 15e4c1f462279b4e128f27de48133e0debe9e0df upstream. The driver's fsync() is supposed to flush any pending operation to hardware. It is implemented in this driver by cancelling the queued deferred IO first, then schedule it for "immediate execution" by calling schedule_delayed_work() again with delay=0. However, setting delay=0 only means the work is scheduled immediately, it does not mean the work is executed immediately. There is no guarantee that the work is finished after schedule_delayed_work() returns. After this driver's fsync() returns, there can still be pending work. Furthermore, if close() is called by users immediately after fsync(), the pending work gets cancelled and fsync() may do nothing. To ensure that the deferred IO completes, use flush_delayed_work() instead. Write operations to this driver either write to the device directly, or invoke schedule_delayed_work(); so by flushing the workqueue, it can be guaranteed that all previous writes make it to the device. Fixes: 5e841b88d23d ("fb: fsync() method for deferred I/O flush.") Cc: stable@vger.kernel.org Signed-off-by: Nam Cao Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman

fbdev/acornfb: Fix name of fb_ops initializer macro

2024-01-25T23:45:13+00:00

commit b48807788e7a2bd93044fe84cfe8ff64b85ec15e upstream. Fix build by using the correct name for the initializer macro for struct fb_ops. Signed-off-by: Thomas Zimmermann Fixes: 9037afde8b9d ("fbdev/acornfb: Use fbdev I/O helpers") Cc: Thomas Zimmermann Cc: Sam Ravnborg Cc: Helge Deller Cc: Javier Martinez Canillas Cc: Arnd Bergmann Cc: # v6.6+ Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-2-tzimmermann@suse.de Signed-off-by: Greg Kroah-Hartman

fbdev: imxfb: fix left margin setting

2024-01-25T23:45:08+00:00

[ Upstream commit 5758844105f7dd9a0a04990cd92499a1a593dd36 ] The previous setting did not take into account the CSTN mode. For the H_WAIT_2 bitfield (bits 0-7) of the LCDC Horizontal Configuration Register (LCDCR), the IMX25RM manual states that: In TFT mode, it specifies the number of SCLK periods between the end of HSYNC and the beginning of OE signal, and the total delay time equals (H_WAIT_2 + 3) of SCLK periods. In CSTN mode, it specifies the number of SCLK periods between the end of HSYNC and the first display data in each line, and the total delay time equals (H_WAIT_2 + 2) of SCLK periods. The patch handles both cases. Fixes: 4e47382fbca9 ("fbdev: imxfb: warn about invalid left/right margin") Fixes: 7e8549bcee00 ("imxfb: Fix margin settings") Signed-off-by: Dario Binacchi Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

fbdev/sm712fb: Use correct initializer macros for struct fb_ops

2024-01-25T23:44:59+00:00

[ Upstream commit 12d55c013a09a2d490f004a324c20800e4ff35ec ] Only initialize mmap and draw helpers with macros; leave read/write callbacks to driver implementations. Fixes the following warnings: CC [M] drivers/video/fbdev/sm712fb.o sm712fb.c:1355:25: warning: initialized field overwritten [-Woverride-init] 1355 | .fb_fillrect = cfb_fillrect, | ^~~~~~~~~~~~ sm712fb.c:1355:25: note: (near initialization for 'smtcfb_ops.fb_fillrect') sm712fb.c:1356:25: warning: initialized field overwritten [-Woverride-init] 1356 | .fb_imageblit = cfb_imageblit, | ^~~~~~~~~~~~~ sm712fb.c:1356:25: note: (near initialization for 'smtcfb_ops.fb_imageblit') sm712fb.c:1357:25: warning: initialized field overwritten [-Woverride-init] 1357 | .fb_copyarea = cfb_copyarea, | ^~~~~~~~~~~~ sm712fb.c:1357:25: note: (near initialization for 'smtcfb_ops.fb_copyarea') sm712fb.c:1358:25: warning: initialized field overwritten [-Woverride-init] 1358 | .fb_read = smtcfb_read, | ^~~~~~~~~~~ sm712fb.c:1358:25: note: (near initialization for 'smtcfb_ops.fb_read') sm712fb.c:1359:25: warning: initialized field overwritten [-Woverride-init] 1359 | .fb_write = smtcfb_write, | ^~~~~~~~~~~~ sm712fb.c:1359:25: note: (near initialization for 'smtcfb_ops.fb_write') Signed-off-by: Thomas Zimmermann Fixes: 586132cf1d38 ("fbdev/sm712fb: Initialize fb_ops to fbdev I/O-memory helpers") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Sudip Mukherjee Cc: Teddy Wang Cc: Sam Ravnborg Cc: Helge Deller Cc: Arnd Bergmann Cc: linux-fbdev@vger.kernel.org Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-3-tzimmermann@suse.de Signed-off-by: Sasha Levin

fbdev: fsl-diu-fb: mark wr_reg_wa() static

2023-11-10T08:16:02+00:00

wr_reg_wa() is not an appropriate name for a global function, and doesn't need to be global anyway, so mark it static and avoid the warning: drivers/video/fbdev/fsl-diu-fb.c:493:6: error: no previous prototype for 'wr_reg_wa' [-Werror=missing-prototypes] Fixes: 0d9dab39fbbe ("powerpc/5121: fsl-diu-fb: fix issue with re-enabling DIU area descriptor") Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller

fbdev: amifb: Convert to platform remove callback returning void

2023-11-10T08:16:02+00:00

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new(), which already returns void. Eventually after all drivers are converted, .remove_new() will be renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller