kernel/linux.git/drivers/video/fbdev/efifb.c, branch v6.6.132

fbdev: efifb: Register sysfs groups through driver core

2024-10-10T09:57:31+00:00

[ Upstream commit 95cdd538e0e5677efbdf8aade04ec098ab98f457 ] The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup. Also avoid a UAF race during unregistering where the sysctl attributes were usable after the info struct was freed. Signed-off-by: Thomas Weißschuh Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

fbdev/efifb: Use fbdev I/O helpers

2023-08-04T13:54:35+00:00

Set struct fb_ops and with FB_DEFAULT_IOMEM_OPS, fbdev's initializer for I/O memory. Sets the callbacks to the cfb_ and fb_io_ functions. Select the correct modules with Kconfig's FB_IOMEM_HELPERS token. The macro and token set the currently selected values, so there is no functional change. v3: * use _IOMEM_ in commit message v2: * updated to use _IOMEM_ tokens Signed-off-by: Thomas Zimmermann Reviewed-by: Sam Ravnborg Acked-by: Helge Deller Cc: Peter Jones Link: https://patchwork.freedesktop.org/patch/msgid/20230803184034.6456-10-tzimmermann@suse.de

fbdev: Remove FBINFO_FLAG_DEFAULT from framebuffer_alloc()'ed structs

2023-07-24T14:50:39+00:00

The flag FBINFO_FLAG_DEFAULT is 0 and has no effect, as struct fbinfo.flags has been allocated to zero by framebuffer_alloc(). So do not set it. Flags should signal differences from the default values. After cleaning up all occurrences of FBINFO_DEFAULT, the token will be removed. v4: * clarify commit message (Geert, Dan) v2: * fix commit message (Miguel) Signed-off-by: Thomas Zimmermann Acked-by: Sam Ravnborg Cc: Jaya Kumar Cc: Helge Deller Cc: Peter Jones Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: Shawn Guo Cc: Fabio Estevam Cc: NXP Linux Team Cc: Maik Broemme Cc: Jingoo Han Cc: Sudip Mukherjee Cc: Teddy Wang Cc: Michal Januszewski Link: https://patchwork.freedesktop.org/patch/msgid/20230715185343.7193-15-tzimmermann@suse.de

fbdev: efifb: Convert to platform remove callback returning void

2023-04-24T09:48:29+00:00

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller

fbdev/efifb: Do not use struct fb_info.apertures

2023-01-13T11:54:29+00:00

Acquire ownership of the firmware scanout buffer by calling Linux' aperture helpers. Remove the use of struct fb_info.apertures and do not set FBINFO_MISC_FIRMWARE; both of which previously configured buffer ownership. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-12-tzimmermann@suse.de

fbdev/efifb: Add struct efifb_par for driver data

2023-01-13T11:54:28+00:00

The efifb_par structure holds the palette for efifb. It will also be useful for storing the device's aperture range. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-11-tzimmermann@suse.de

Merge drm/drm-next into drm-misc-next

2022-06-20T16:21:25+00:00

Backmerging to get new regmap APIs of v5.19-rc1. Signed-off-by: Thomas Zimmermann

Revert "fbdev: Prevent probing generic drivers if a FB is already registered"

2022-06-09T14:22:03+00:00

This reverts commit fb561bf9abde49f7e00fdbf9ed2ccf2d86cac8ee. With commit 27599aacbaefcbf2af7b06b0029459bbf682000d Author: Thomas Zimmermann Date: Tue Jan 25 10:12:18 2022 +0100 fbdev: Hot-unplug firmware fb devices on forced removal this should be fixed properly and we can remove this somewhat hackish check here (e.g. this won't catch drm drivers if fbdev emulation isn't enabled). Cc: Thomas Zimmermann Cc: Zack Rusin Cc: Javier Martinez Canillas Cc: Zack Rusin Cc: Hans de Goede Cc: Ilya Trukhanov Signed-off-by: Daniel Vetter Signed-off-by: Daniel Vetter Reviewed-by: Javier Martinez Canillas Cc: Peter Jones Cc: linux-fbdev@vger.kernel.org Signed-off-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220607182338.344270-5-javierm@redhat.com

fbdev: efifb: Fix a use-after-free due early fb_info cleanup

2022-05-07T16:05:48+00:00

Commit d258d00fb9c7 ("fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove") attempted to fix a use-after-free error due driver freeing the fb_info in the .remove handler instead of doing it in .fb_destroy. But ironically that change introduced yet another use-after-free since the fb_info was still used after the free. This should fix for good by freeing the fb_info at the end of the handler. Fixes: d258d00fb9c7 ("fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove") Reported-by: Ville Syrjälä Reported-by: Andrzej Hajda Signed-off-by: Javier Martinez Canillas Reviewed-by: Andi Shyti Reviewed-by: Andrzej Hajda Reviewed-by: Thomas Zimmermann Signed-off-by: Lucas De Marchi Link: https://patchwork.freedesktop.org/patch/msgid/20220506132225.588379-1-javierm@redhat.com

fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove

2022-05-06T07:21:22+00:00

The driver is calling framebuffer_release() in its .remove callback, but this will cause the struct fb_info to be freed too early. Since it could be that a reference is still hold to it if user-space opened the fbdev. This would lead to a use-after-free error if the framebuffer device was unregistered but later a user-space process tries to close the fbdev fd. To prevent this, move the framebuffer_release() call to fb_ops.fb_destroy instead of doing it in the driver's .remove callback. Strictly speaking, the code flow in the driver is still wrong because all the hardware cleanupd (i.e: iounmap) should be done in .remove while the software cleanup (i.e: releasing the framebuffer) should be done in the .fb_destroy handler. But this at least makes to match the behavior before commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal"). Fixes: 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal") Suggested-by: Daniel Vetter Signed-off-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Reviewed-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20220505220540.366218-1-javierm@redhat.com