kernel/linux.git/drivers/video/fbdev/pxafb.c, branch v6.6.133

fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing

2026-01-11T14:22:14+00:00

commit 0155e868cbc111846cc2809c1546ea53810a56ae upstream. The variables were never clamped because the return value of clamp_val() was not used. Fix this by assigning the clamped values, and use clamp() instead of clamp_val(). Cc: stable@vger.kernel.org Fixes: 3f16ff608a75 ("[ARM] pxafb: cleanup of the timing checking code") Signed-off-by: Thorsten Blum Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman

fbdev: pxafb: Fix possible use after free in pxafb_task()

2024-10-10T09:57:31+00:00

[ Upstream commit 4a6921095eb04a900e0000da83d9475eb958e61e ] In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime. Signed-off-by: Kaixin Wang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

fbdev/pxafb: Use fbdev I/O helpers

2023-08-04T13:54:37+00:00

Set struct fb_ops and with FB_DEFAULT_IOMEM_OPS, fbdev's initializer for I/O memory. Sets the callbacks to the cfb_ and fb_io_ functions. Select the correct modules with Kconfig's FB_IOMEM_HELPERS token. The macro and token set the currently selected values, so there is no functional change. v3: * use _IOMEM_ in commit message v2: * updated to use _IOMEM_ tokens Signed-off-by: Thomas Zimmermann Reviewed-by: Sam Ravnborg Acked-by: Helge Deller Link: https://patchwork.freedesktop.org/patch/msgid/20230803184034.6456-36-tzimmermann@suse.de

fbdev/pxafb: Remove flag FBINFO_FLAG_DEFAULT

2023-07-24T14:50:39+00:00

The flag FBINFO_FLAG_DEFAULT is 0 and has no effect, as struct fbinfo.flags has been allocated to zero by devm_kzalloc(). So do not set it. Flags should signal differences from the default values. After cleaning up all occurrences of FBINFO_DEFAULT, the token will be removed. v2: * fix commit message (Miguel) Signed-off-by: Thomas Zimmermann Acked-by: Sam Ravnborg Cc: Helge Deller Link: https://patchwork.freedesktop.org/patch/msgid/20230715185343.7193-17-tzimmermann@suse.de

fbdev: Remove FBINFO_DEFAULT from devm_kzalloc()'ed structs

2023-07-24T14:50:38+00:00

The flag FBINFO_DEFAULT is 0 and has no effect, as struct fbinfo.flags has been allocated to zero by devm_kzalloc(). So do not set it. Flags should signal differences from the default values. After cleaning up all occurrences of FBINFO_DEFAULT, the token will be removed. v4: * clarify commit message (Geert, Dan) v2: * fix commit message (Miguel) Signed-off-by: Thomas Zimmermann Acked-by: Sam Ravnborg Cc: Helge Deller Link: https://patchwork.freedesktop.org/patch/msgid/20230715185343.7193-5-tzimmermann@suse.de

fbdev: pxafb: Convert to platform remove callback returning void

2023-04-24T09:48:31+00:00

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Helge Deller

fbdev: pxafb: Remove unnecessary print function dev_err()

2022-12-14T19:01:50+00:00

Eliminate the follow coccicheck warning: ./drivers/video/fbdev/pxafb.c:2330:2-9: line 2330 is redundant because platform_get_irq() already prints an error Signed-off-by: KaiLong Wang Signed-off-by: Helge Deller

fbdev: Move fbdev drivers from strlcpy to strscpy

2022-08-24T20:06:15+00:00

Follow the advice of the below link and prefer 'strscpy' in this subsystem. Conversion is 1:1 because the return value is not used. Generated by a coccinelle script. Link: https://lore.kernel.org/r/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Wolfram Sang Signed-off-by: Helge Deller

Merge tag 'arm-multiplatform-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2022-06-02T22:23:54+00:00

Pull more ARM multiplatform updates from Arnd Bergmann: "The second part of the multiplatform changes now converts the Intel/Marvell PXA platform along with the rest. The patches went through several rebases before the merge window as bugs were found, so they remained separate. This has to touch a lot of drivers, in particular the touchscreen, pcmcia, sound and clk bits, to detach the driver files from the platform and board specific header files" * tag 'arm-multiplatform-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (48 commits) ARM: pxa/mmp: remove traces of plat-pxa ARM: pxa: convert to multiplatform ARM: pxa/sa1100: move I/O space to PCI_IOBASE ARM: pxa: remove support for MTD_XIP ARM: pxa: move mach/*.h to mach-pxa/ ARM: PXA: fix multi-cpu build of xsc3 ARM: pxa: move plat-pxa to drivers/soc/ ARM: mmp: rename pxa_register_device ARM: mmp: remove tavorevb board support ARM: pxa: remove unused mach/bitfield.h ARM: pxa: move clk register definitions to driver ARM: pxa: move smemc register access from clk to platform cpufreq: pxa3: move clk register access to clk driver ARM: pxa: remove get_clk_frequency_khz() ARM: pxa: pcmcia: move smemc configuration back to arch ASoC: pxa: i2s: use normal MMIO accessors ASoC: pxa: ac97: use normal MMIO accessors ASoC: pxa: use pdev resource for FIFO regs Input: wm97xx - get rid of irq_enable method in wm97xx_mach_ops Input: wm97xx - switch to using threaded IRQ ...

ARM: pxa: move regs-lcd.h into driver

2022-04-19T14:29:03+00:00

Only the pxafb driver uses this header, so move it into the same directory. The SMART_* macros are required by some platform data definitions and can go into the linux/platform_data/video-pxafb.h header. Acked-by: Bartlomiej Zolnierkiewicz Acked-by: Robert Jarzmik Cc: dri-devel@lists.freedesktop.org Cc: linux-fbdev@vger.kernel.org Signed-off-by: Arnd Bergmann