kernel/linux.git/drivers/video/fbdev/core/bitblit.c, branch v6.19.11

Merge tag 'v6.18-rc6' into drm-next

2025-11-20T22:55:08+00:00

Linux 6.18-rc6 Backmerge in order to merge msm next Signed-off-by: Dave Airlie

fbdev: bitblit: bound-check glyph index in bit_putcs*

2025-10-28T21:59:19+00:00

bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot. Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2 Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com Signed-off-by: Junjie Cao Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller Cc: stable@vger.kernel.org

Merge tag 'drm-misc-next-2025-10-02' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2025-10-21T08:16:34+00:00

drm-misc-next for v6.19: UAPI Changes: Cross-subsystem Changes: - fbcon cleanups. - Make drivers depend on FB_TILEBLITTING instead of selecting it, and hide FB_MODE_HELPERS. Core Changes: - More preparations for rust. - Throttle dirty worker with vblank - Use drm_for_each_bridge_in_chain_scoped in drm's bridge code and assorted fixes. - Ensure drm_client_modeset tests are enabled in UML. - Rename ttm_bo_put to ttm_bo_fini, as a further step in removing the TTM bo refcount. - Add POST_LT_ADJ_REQ training sequence. - Show list of removed but still allocated bridges. - Add a simulated vblank interrupt for hardware without it, and add some helpers to use them in vkms and hypervdrm. Driver Changes: - Assorted small fixes, cleanups and updates to host1x, tegra, panthor, amdxdna, gud, vc4, ssd130x, ivpu, panfrost, panthor, sysfb, bridge/sn65dsi86, solomon, ast, tidss. - Convert drivers from using .round_rate() to .determine_rate() - Add support for KD116N3730A07/A12, chromebook mt8189, JT101TM023, LQ079L1SX01, raspberrypi 5" panels. - Improve reclocking on tegra186+ with nouveau. - Improve runtime pm in amdxdna. - Add support for HTX_PAI in imx. - Use a helper to calculate dumb buffer sizes in most drivers. Signed-off-by: Simona Vetter From: Maarten Lankhorst Link: https://lore.kernel.org/r/b412fb91-8545-466a-8102-d89c0f2758a7@linux.intel.com

fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

2025-10-04T00:41:29+00:00

Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Suggested-by: Helge Deller Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com Signed-off-by: Albin Babu Varghese Signed-off-by: Helge Deller

fbcon: Streamline setting rotated/unrotated bitops

2025-09-19T08:04:06+00:00

Support for console rotation is somewhat bolted onto the helper fbcon_set_bitops() for unrotated displays. Update fbcon_set_bitops() with a switch statement that picks the correct settings helper for the current rotation. For unrotated consoles, set the bitops for in the new helper fbcon_set_bitops_ur(). Rename the other, existing helpers to match the common naming scheme. The old helper fbcon_set_rotate() is no longer used. Signed-off-by: Thomas Zimmermann Reviewed-by: Sam Ravnborg Link: https://lore.kernel.org/r/20250909124616.143365-6-tzimmermann@suse.de

fbcon: Move fbcon callbacks into struct fbcon_bitops

2025-09-19T08:04:05+00:00

Depending on rotation settings, fbcon sets different callback functions in struct fbcon_par from within fbcon_set_bitops(). Declare the callback functions in the new type struct fbcon_bitops. Then only replace the single bitops pointer in struct fbcon_par. Keeping callbacks in constant instances of struct fbcon_bitops makes it harder to exploit the callbacks. Also makes the code slightly easier to maintain. For tile-based consoles, there's a separate instance of the bitops structure. Signed-off-by: Thomas Zimmermann Reviewed-by: Sam Ravnborg Link: https://lore.kernel.org/r/20250909124616.143365-5-tzimmermann@suse.de

fbcon: Rename struct fbcon_ops to struct fbcon_par

2025-09-19T08:04:02+00:00

The type struct fbcon_ops contains fbcon state and callbacks. As the callbacks will be removed from struct fbcon_ops, rename the data type to struct fbcon_par. Also rename the variables from ops to par. The _par postfix ("private access registers") is used throughout the fbdev subsystem for per-driver state. The fbcon pointer within struct fb_info is also named fbcon_par. Hence, the new naming fits existing practice. v2: - rename struct fbcon_ops to struct fbcon_par - fix build for CONFIG_FB_TILEBITTING=n (kernel test robot) - fix indention Signed-off-by: Thomas Zimmermann Reviewed-by: Sam Ravnborg Link: https://lore.kernel.org/r/20250909124616.143365-3-tzimmermann@suse.de

fbcon: Use correct erase colour for clearing in fbcon

2025-03-26T21:39:19+00:00

The erase colour calculation for fbcon clearing should use get_color instead of attr_col_ec, like everything else. The latter is similar but is not correct. For example it's missing the depth dependent remapping and doesn't care about blanking. The problem can be reproduced by setting up the background colour to grey (vt.color=0x70) and having an fbcon console set to 2bpp (4 shades of gray). Now the background attribute should be 1 (dark gray) on the console. If the screen is scrolled when pressing enter in a shell prompt at the bottom line then the new line is cleared using colour 7 instead of 1. That's not something fillrect likes (at 2bbp it expect 0-3) so the result is interesting. This patch switches to get_color with vc_video_erase_char to determine the erase colour from attr_col_ec. That makes the latter function redundant as no other users were left. Use correct erase colour for clearing in fbcon Signed-off-by: Zsolt Kajtar Signed-off-by: Helge Deller

tty: vt: remove CM_* constants

2024-01-28T02:08:54+00:00

There is no difference between CM_MOVE and CM_DRAW. Either of them enables the cursor. CM_ERASE then disables cursor. So get rid of all of them and use simple "bool enable". Note that this propagates down to the fbcon code. And document the hook. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Daniel Vetter Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linux-parisc@vger.kernel.org Tested-by: Helge Deller # parisc STI console Link: https://lore.kernel.org/r/20240122110401.7289-30-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

fbdev/core: simplify cursor_state setting in fbcon_ops::cursor()

2024-01-28T02:08:54+00:00

There is a switch decicing if cursor should be drawn or not. The whole switch can be simplified to one line. Do this cleanup as a preparatory work for the next patch. There, all the CM_* constants are removed. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Daniel Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Tested-by: Helge Deller # parisc STI console Link: https://lore.kernel.org/r/20240122110401.7289-29-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman