kernel/linux.git/drivers/video/fbdev/imsttfb.c, branch v5.10.258

fbdev: imsttfb: fix a resource leak in probe

2023-11-20T10:06:57+00:00

[ Upstream commit aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b ] I've re-written the error handling but the bug is that if init_imstt() fails we need to call iounmap(par->cmap_regs). Fixes: c75f5a550610 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe") Signed-off-by: Dan Carpenter Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

fbdev: imsttfb: Fix error path of imsttfb_probe()

2023-11-20T10:06:57+00:00

[ Upstream commit 518ecb6a209f6ff678aeadf9f2bf870c0982ca85 ] Release ressources when init_imstt() returns failure. Signed-off-by: Helge Deller Stable-dep-of: aba6ab57a910 ("fbdev: imsttfb: fix a resource leak in probe") Signed-off-by: Sasha Levin

fbdev: imsttfb: Fix use after free bug in imsttfb_probe

2023-07-27T06:43:30+00:00

commit c75f5a55061091030a13fef71b9995b89bc86213 upstream. A use-after-free bug may occur if init_imstt invokes framebuffer_release and free the info ptr. The caller, imsttfb_probe didn't notice that and still keep the ptr as private data in pdev. If we remove the driver which will call imsttfb_remove to make cleanup, UAF happens. Fix it by return error code if bad case happens in init_imstt. Signed-off-by: Zheng Wang Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman

video: imsttfb: check for ioremap() failures

2023-07-27T06:43:30+00:00

commit 13b7c0390a5d3840e1e2cda8f44a310fdbb982de upstream. We should check if ioremap() were to somehow fail in imsttfb_probe() and handle the unwinding of the resources allocated here properly. Ideally if anyone cares about this driver (it's for a PowerMac era PCI display card), they wouldn't even be using fbdev anymore. Or the devm_* apis could be used, but that's just extra work for diminishing returns... Cc: Finn Thain Cc: Bartlomiej Zolnierkiewicz Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20210503115736.2104747-68-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

Revert "video: imsttfb: fix potential NULL pointer dereferences"

2021-05-26T10:06:54+00:00

commit ed04fe8a0e87d7b5ea17d47f4ac9ec962b24814a upstream. This reverts commit 1d84353d205a953e2381044953b7fa31c8c9702d. Because of recent interactions with developers from @umn.edu, all commits from them have been recently re-reviewed to ensure if they were correct or not. Upon review, this commit was found to be incorrect for the reasons below, so it must be reverted. It will be fixed up "correctly" in a later kernel change. The original commit here, while technically correct, did not fully handle all of the reported issues that the commit stated it was fixing, so revert it until it can be "fixed" fully. Note, ioremap() probably will never fail for old hardware like this, and if anyone actually used this hardware (a PowerMac era PCI display card), they would not be using fbdev anymore. Cc: Kangjie Lu Cc: Aditya Pakki Cc: Finn Thain Cc: Bartlomiej Zolnierkiewicz Reviewed-by: Rob Herring Fixes: 1d84353d205a ("video: imsttfb: fix potential NULL pointer dereferences") Cc: stable Link: https://lore.kernel.org/r/20210503115736.2104747-67-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

video: constify fb ops across all drivers

2019-12-05T08:57:53+00:00

Now that the fbops member of struct fb_info is const, we can start making the ops const as well. This does not cover all drivers; some actually modify the fbops struct, for example to adjust for different configurations, and others do more involved things that I'd rather not touch in practically obsolete drivers. Mostly this is the low hanging fruit where we can add "const" and be done with it. v3: - un-constify atyfb, mb862xx, nvidia and uvesabf (0day) v2: - fix typo (Christophe de Dinechin) - use "static const" instead of "const static" in mx3fb.c - also constify smscufx.c Cc: linux-fbdev@vger.kernel.org Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/ce67f14435f3af498f2e8bf35ce4be11f7504132.1575390740.git.jani.nikula@intel.com

video: fbdev: don't print error message on framebuffer_alloc() failure

2019-06-28T10:30:08+00:00

framebuffer_alloc() can fail only on kzalloc() memory allocation failure and since kzalloc() will print error message in such case we can omit printing extra error message in drivers (which BTW is what the majority of framebuffer_alloc() users is doing already). Cc: "Bruno Prémont" Cc: Jiri Kosina Cc: Benjamin Tissoires Signed-off-by: Bartlomiej Zolnierkiewicz

video: imsttfb: fix potential NULL pointer dereferences

2019-04-01T15:46:58+00:00

In case ioremap fails, the fix releases resources and returns -ENOMEM to avoid NULL pointer dereferences. Signed-off-by: Kangjie Lu Cc: Aditya Pakki Cc: Finn Thain Cc: Rob Herring Cc: Greg Kroah-Hartman [b.zolnierkie: minor patch summary fixup] Signed-off-by: Bartlomiej Zolnierkiewicz

Merge tag 'fbdev-v5.1' of git://github.com/bzolnier/linux

2019-03-15T21:22:59+00:00

Pull fbdev updates from Bartlomiej Zolnierkiewicz: "Just a couple of small fixes and cleanups: - fix memory access if logo is bigger than the screen (Manfred Schlaegl) - silence fbcon logo on 'quiet' boots (Prarit Bhargava) - use kvmalloc() for scrollback buffer in fbcon (Konstantin Khorenko) - misc fixes (Colin Ian King, YueHaibing, Matteo Croce, Mathieu Malaterre, Anders Roxell, Arnd Bergmann) - misc cleanups (Rob Herring, Lubomir Rintel, Greg Kroah-Hartman, Jani Nikula, Michal Vokáč)" * tag 'fbdev-v5.1' of git://github.com/bzolnier/linux: fbdev: mbx: fix a misspelled variable name fbdev: omap2: fix warnings in dss core video: fbdev: Fix potential NULL pointer dereference fbcon: Silence fbcon logo on 'quiet' boots printk: Export console_printk ARM: dts: imx28-cfa10036: Fix the reset gpio signal polarity video: ssd1307fb: Do not hard code active-low reset sequence dt-bindings: display: ssd1307fb: Remove reset-active-low from examples fbdev: fbmem: fix memory access if logo is bigger than the screen video/fbdev: refactor video= cmdline parsing fbdev: mbx: fix up debugfs file creation fbdev: omap2: no need to check return value of debugfs_create functions video: fbdev: geode: remove ifdef OLPC noise video: offb: annotate implicit fall throughs omapfb: fix typo fbdev: Use of_node_name_eq for node name comparisons fbcon: use kvmalloc() for scrollback buffer fbdev: chipsfb: remove set but not used variable 'size' fbdev/via: fix spelling mistake "Expandsion" -> "Expansion"

fbdev: Use of_node_name_eq for node name comparisons

2019-02-08T18:24:45+00:00

Convert string compares of DT node names to use of_node_name_eq helper instead. This removes direct access to the node name pointer. For instances using of_node_cmp, this has the side effect of now using case sensitive comparisons. This should not matter for any FDT based system which omap is. Signed-off-by: Rob Herring Cc: Benjamin Herrenschmidt Signed-off-by: Bartlomiej Zolnierkiewicz