kernel/linux.git/drivers/video/fbdev/core, branch v4.4.171

fbdev: Distinguish between interlaced and progressive modes

2018-09-26T06:35:06+00:00

[ Upstream commit 1ba0a59cea41ea05fda92daaf2a2958a2246b9cf ] I discovered the problem when developing a frame buffer driver for the PlayStation 2 (not yet merged), using the following video modes for the PlayStation 3 in drivers/video/fbdev/ps3fb.c: }, { /* 1080if */ "1080if", 50, 1920, 1080, 13468, 148, 484, 36, 4, 88, 5, FB_SYNC_BROADCAST, FB_VMODE_INTERLACED }, { /* 1080pf */ "1080pf", 50, 1920, 1080, 6734, 148, 484, 36, 4, 88, 5, FB_SYNC_BROADCAST, FB_VMODE_NONINTERLACED }, In ps3fb_probe, the mode_option module parameter is used with fb_find_mode but it can only select the interlaced variant of 1920x1080 since the loop matching the modes does not take the difference between interlaced and progressive modes into account. In short, without the patch, progressive 1920x1080 cannot be chosen as a mode_option parameter since fb_find_mode (falsely) thinks interlace is a perfect match. Signed-off-by: Fredrik Noring Cc: "Maciej W. Rozycki" [b.zolnierkie: updated patch description] Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

fb: fix lost console when the user unplugs a USB adapter

2018-09-09T18:04:35+00:00

commit 8c5b044299951acd91e830a688dd920477ea1eda upstream. I have a USB display adapter using the udlfb driver and I use it on an ARM board that doesn't have any graphics card. When I plug the adapter in, the console is properly displayed, however when I unplug and re-plug the adapter, the console is not displayed and I can't access it until I reboot the board. The reason is this: When the adapter is unplugged, dlfb_usb_disconnect calls unlink_framebuffer, then it waits until the reference count drops to zero and then it deallocates the framebuffer. However, the console that is attached to the framebuffer device keeps the reference count non-zero, so the framebuffer device is never destroyed. When the USB adapter is plugged again, it creates a new device /dev/fb1 and the console is not attached to it. This patch fixes the bug by unbinding the console from unlink_framebuffer. The code to unbind the console is moved from do_unregister_framebuffer to a function unbind_console. When the console is unbound, the reference count drops to zero and the udlfb driver frees the framebuffer. When the adapter is plugged back, a new framebuffer is created and the console is attached to it. Signed-off-by: Mikulas Patocka Cc: Dave Airlie Cc: Bernie Thompson Cc: Ladislav Michl Cc: stable@vger.kernel.org [b.zolnierkie: preserve old behavior for do_unregister_framebuffer()] Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Greg Kroah-Hartman

fbdev: color map copying bounds checking

2017-02-01T07:30:52+00:00

commit 2dc705a9930b4806250fbf5a76e55266e59389f2 upstream. Copying color maps to userspace doesn't check the value of to->start, which will cause kernel heap buffer OOB read due to signedness wraps. CVE-2016-8405 Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kees Cook Reported-by: Peter Pi (@heisecode) of Trend Micro Cc: Min Chong Cc: Dan Carpenter Cc: Tomi Valkeinen Cc: Bartlomiej Zolnierkiewicz Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

fb_ddc: Allow I2C adapters without SCL read capability

2015-09-30T07:46:55+00:00

i2c-algo-bit allows I2C adapters without SCL read capability to work but fb_ddc_read fails to work on them. Fix fb_ddc_read to work with I2C adapters not capable of reading SCL. Signed-off-by: Ondrej Zary Signed-off-by: Tomi Valkeinen

fbdev: fix snprintf() limit in show_bl_curve()

2015-09-01T10:52:23+00:00

The limit should be "PAGE_SIZE - len" instead of PAGE_SIZE. Also let's use scnprintf() because snprintf() returns the number of bytes which would have been printed if there were space and scnprintf() returns the number of bytes actually printed. I don't think we are ever going to actually hit this limit in real life. Signed-off-by: Dan Carpenter Signed-off-by: Tomi Valkeinen

fbdev: fix cea_modes array size

2015-08-20T07:20:11+00:00

CEA defines 64 modes, indexed from 1 to 64. modedb has cea_modes arrays, which contains 64 entries. However, the code uses the CEA indices directly, i.e. the first mode is at cea_modes[1]. This means the array is one too short. This does not cause references to uninitialized memory as the code in fbmon only allows indexes up to 63, and the cea_modes does not contain an entry for the mode 64 so it could not be used in any case. However, the code contains a check 'if (idx > ARRAY_SIZE(cea_modes)', and while that check is a no-op as at that point idx cannot be >= 63, it upsets static checkers. Fix this by increasing the cea_array size to be 65, and change the code to allow mode 64. Signed-off-by: Tomi Valkeinen Reported-by: Dan Carpenter

fbdev: propagate result of fb_videomode_from_videomode()

2015-06-16T07:06:36+00:00

fb_videomode_from_videomode() may fail, but of_get_fb_videomode() silently covers this fact. Instead, trow the error code to the caller. Signed-off-by: Vladimir Murzin Signed-off-by: Tomi Valkeinen

framebuffer: don't link fb_devio into kernel image unconditionally

2015-05-07T10:59:45+00:00

CONFIG_FB_DEFERRED_IO is defined as bool while CONFIG_FB is defined as tristate. Currently fb_defio.o is linked into the kernel image even if CONFIG_FB=m. I fix this by updating the Makefile to link fb_defio.o into fb.o and thus go into one place with the other core framebuffer code. Signed-off-by: Harald Geyer Signed-off-by: Tomi Valkeinen

fbdev: remove the unnecessary includes of ppc specific header files

2015-03-17T09:04:32+00:00

In the current kernel, we don't need to include these arch specific header files for ppc. Signed-off-by: Kevin Hao Acked-by: Benjamin Herrenschmidt Acked-by: Tomi Valkeinen Signed-off-by: Michael Ellerman

video: fbdev: fix possible null dereference

2015-02-26T08:23:15+00:00

we were dereferencing edid first and the NULL check was after accessing that. now we are using edid only if we know that it is not NULL. Signed-off-by: Sudip Mukherjee Signed-off-by: Tomi Valkeinen