Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev fixes from Helge Deller:
- atyfb: Avoid hard lock up when PLL not initialized (Daniel Palmer)
- pvr2fb: Fix build error when CONFIG_PVR2_DMA enabled (Florian Fuchs)
- bitblit: Fix out-of-bounds read in bit_putcs* (Junjie Cao)
- valkyriefb: Fix reference count leak (Miaoqian Lin)
- fbcon: Fix slab-use-after-free in fb_mode_is_equal (Quanmin Yan)
- fb.h: Fix typo in "vertical" (Piyush Choudhary)
* tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
fbdev: atyfb: Check if pll_ops->init_pll failed
fbcon: Set fb_display[i]->mode to NULL when the mode is released
fbdev: bitblit: bound-check glyph index in bit_putcs*
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
video: fb: Fix typo in comment in fb.h
+44
-8
+6
-2
drivers/video/fbdev/aty/atyfb_base.c
+6
-2
drivers/video/fbdev/aty/atyfb_base.c
···
2614
2614
pr_cont("\n");
2615
2615
}
2616
2616
#endif
2617
-
if (par->pll_ops->init_pll)
2618
-
par->pll_ops->init_pll(info, &par->pll);
2617
+
if (par->pll_ops->init_pll) {
2618
+
ret = par->pll_ops->init_pll(info, &par->pll);
2619
+
if (ret)
2620
+
return ret;
2621
+
}
2622
+
2619
2623
if (par->pll_ops->resume_pll)
2620
2624
par->pll_ops->resume_pll(info, &par->pll);
2621
2625
+12
-4
drivers/video/fbdev/core/bitblit.c
+12
-4
drivers/video/fbdev/core/bitblit.c
···
79
79
struct fb_image *image, u8 *buf, u8 *dst)
80
80
{
81
81
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
82
+
unsigned int charcnt = vc->vc_font.charcount;
82
83
u32 idx = vc->vc_font.width >> 3;
83
84
u8 *src;
84
85
85
86
while (cnt--) {
86
-
src = vc->vc_font.data + (scr_readw(s++)&
87
-
charmask)*cellsize;
87
+
u16 ch = scr_readw(s++) & charmask;
88
+
89
+
if (ch >= charcnt)
90
+
ch = 0;
91
+
src = vc->vc_font.data + (unsigned int)ch * cellsize;
88
92
89
93
if (attr) {
90
94
update_attr(buf, src, attr, vc);
···
116
112
u8 *dst)
117
113
{
118
114
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
115
+
unsigned int charcnt = vc->vc_font.charcount;
119
116
u32 shift_low = 0, mod = vc->vc_font.width % 8;
120
117
u32 shift_high = 8;
121
118
u32 idx = vc->vc_font.width >> 3;
122
119
u8 *src;
123
120
124
121
while (cnt--) {
125
-
src = vc->vc_font.data + (scr_readw(s++)&
126
-
charmask)*cellsize;
122
+
u16 ch = scr_readw(s++) & charmask;
123
+
124
+
if (ch >= charcnt)
125
+
ch = 0;
126
+
src = vc->vc_font.data + (unsigned int)ch * cellsize;
127
127
128
128
if (attr) {
129
129
update_attr(buf, src, attr, vc);
+19
drivers/video/fbdev/core/fbcon.c
+19
drivers/video/fbdev/core/fbcon.c
···
2810
2810
return found;
2811
2811
}
2812
2812
2813
+
static void fbcon_delete_mode(struct fb_videomode *m)
2814
+
{
2815
+
struct fbcon_display *p;
2816
+
2817
+
for (int i = first_fb_vc; i <= last_fb_vc; i++) {
2818
+
p = &fb_display[i];
2819
+
if (p->mode == m)
2820
+
p->mode = NULL;
2821
+
}
2822
+
}
2823
+
2824
+
void fbcon_delete_modelist(struct list_head *head)
2825
+
{
2826
+
struct fb_modelist *modelist;
2827
+
2828
+
list_for_each_entry(modelist, head, list)
2829
+
fbcon_delete_mode(&modelist->mode);
2830
+
}
2831
+
2813
2832
#ifdef CONFIG_VT_HW_CONSOLE_BINDING
2814
2833
static void fbcon_unbind(void)
2815
2834
{
+1
drivers/video/fbdev/core/fbmem.c
+1
drivers/video/fbdev/core/fbmem.c
+1
-1
drivers/video/fbdev/pvr2fb.c
+1
-1
drivers/video/fbdev/pvr2fb.c
···
192
192
193
193
#ifdef CONFIG_PVR2_DMA
194
194
static unsigned int shdma = PVR2_CASCADE_CHAN;
195
-
static unsigned int pvr2dma = ONCHIP_NR_DMA_CHANNELS;
195
+
static unsigned int pvr2dma = CONFIG_NR_ONCHIP_DMA_CHANNELS;
196
196
#endif
197
197
198
198
static struct fb_videomode pvr2_modedb[] = {
+2
drivers/video/fbdev/valkyriefb.c
+2
drivers/video/fbdev/valkyriefb.c
···
329
329
330
330
if (of_address_to_resource(dp, 0, &r)) {
331
331
printk(KERN_ERR "can't find address for valkyrie\n");
332
+
of_node_put(dp);
332
333
return 0;
333
334
}
334
335
335
336
frame_buffer_phys = r.start;
336
337
cmap_regs_phys = r.start + 0x304000;
338
+
of_node_put(dp);
337
339
}
338
340
#endif /* ppc (!CONFIG_MAC) */
339
341
+2
include/linux/fbcon.h
+2
include/linux/fbcon.h
···
18
18
void fbcon_resumed(struct fb_info *info);
19
19
int fbcon_mode_deleted(struct fb_info *info,
20
20
struct fb_videomode *mode);
21
+
void fbcon_delete_modelist(struct list_head *head);
21
22
void fbcon_new_modelist(struct fb_info *info);
22
23
void fbcon_get_requirement(struct fb_info *info,
23
24
struct fb_blit_caps *caps);
···
39
38
static inline void fbcon_resumed(struct fb_info *info) {}
40
39
static inline int fbcon_mode_deleted(struct fb_info *info,
41
40
struct fb_videomode *mode) { return 0; }
41
+
static inline void fbcon_delete_modelist(struct list_head *head) {}
42
42
static inline void fbcon_new_modelist(struct fb_info *info) {}
43
43
static inline void fbcon_get_requirement(struct fb_info *info,
44
44
struct fb_blit_caps *caps) {}
+1
-1
include/uapi/linux/fb.h
+1
-1
include/uapi/linux/fb.h
···
319
319
#define FB_VBLANK_HAVE_VCOUNT 0x020 /* the vcount field is valid */
320
320
#define FB_VBLANK_HAVE_HCOUNT 0x040 /* the hcount field is valid */
321
321
#define FB_VBLANK_VSYNCING 0x080 /* currently in a vsync */
322
-
#define FB_VBLANK_HAVE_VSYNC 0x100 /* verical syncs can be detected */
322
+
#define FB_VBLANK_HAVE_VSYNC 0x100 /* vertical syncs can be detected */
323
323
324
324
struct fb_vblank {
325
325
__u32 flags; /* FB_VBLANK flags */