kernel/linux.git/include/video, branch v5.15.209

fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free

2026-06-01T15:35:19+00:00

commit 8de779dc40d35d39fa07387b6f921eb11df0f511 upstream. dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation. Signed-off-by: Rajat Gupta Acked-by: Greg Kroah-Hartman Cc: stable@vger.kernel.org Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman

video: of_display_timing.h: include errno.h

2022-07-12T14:35:10+00:00

commit 3663a2fb325b8782524f3edb0ae32d6faa615109 upstream. If CONFIG_OF is not enabled, default of_get_display_timing() returns an errno, so include the header. Fixes: 422b67e0b31a ("videomode: provide dummy inline functions for !CONFIG_OF") Suggested-by: Stephen Boyd Signed-off-by: Hsin-Yi Wang Reviewed-by: Stephen Boyd Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman

gpu: ipu-v3: Add Rec.709 limited range support to DP

2021-05-10T15:20:29+00:00

Add YCbCr encoding and quantization range parameters to ipu_dp_setup_channel() and configure the CSC DP matrix accordingly. Signed-off-by: Philipp Zabel

video: fbdev: sstfb: Updated logging to fix set but not used warnings

2020-11-30T19:04:59+00:00

Fix set but not used warnings by introducing no_printk variants for the internal logging system for this driver. Fix a new warning that popped up now that logging was checked for correct printf format strings. A more invasive fix had been to replace all the internal logging with standard logging primitives - thats for another day. v2: - Update subject (Lee) Signed-off-by: Sam Ravnborg Acked-by: Thomas Zimmermann Cc: Sam Ravnborg Cc: Daniel Vetter Cc: Arnd Bergmann Cc: Bartlomiej Zolnierkiewicz Cc: Alex Dewar Cc: Jani Nikula Cc: linux-fbdev@vger.kernel.org Cc: Lee Jones Link: https://patchwork.freedesktop.org/patch/msgid/20201128224114.1033617-20-sam@ravnborg.org

gpu: ipu-v3: remove unused functions

2020-10-26T09:42:38+00:00

ipu_mbus_code_to_colorspace, ipu_stride_to_bytes, and ipu_pixelformat_is_planar are unused. Remove them. Signed-off-by: Philipp Zabel Reviewed-by: Sam Ravnborg

fbdev: remove mbx framebuffer driver

2020-09-08T11:33:32+00:00

The only in-tree user for mbx driver for Intel 2700G graphics chip was cm-x270 platform. Since this platform was removed by the commit 9d3239147d6d ("ARM: pxa: remove Compulab pxa2xx boards") there is no point to keep the obsolete framebuffer driver. Signed-off-by: Mike Rapoport Cc: Jonathan Corbet Cc: Arnd Bergmann Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/20200830115524.431278-1-rppt@kernel.org

video: Replace zero-length array with flexible-array member

2020-03-02T15:32:17+00:00

The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/20200221160005.GA13552@embeddedor

video: exynos: Rename Exynos to lowercase

2020-01-15T16:31:51+00:00

Fix up inconsistent usage of upper and lowercase letters in "Exynos" name. "EXYNOS" is not an abbreviation but a regular trademarked name. Therefore it should be written with lowercase letters starting with capital letter. The lowercase "Exynos" name is promoted by its manufacturer Samsung Electronics Co., Ltd., in advertisement materials and on website. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/20200104152107.11407-16-krzk@kernel.org

drm/dsi: rename MIPI_DCS_SET_PARTIAL_AREA to MIPI_DCS_SET_PARTIAL_ROWS

2019-11-07T12:59:56+00:00

The DCS command has been named SET_PARTIAL_ROWS in the DCS spec since v1.02, for more than a decade. Rename the enumeration to match the spec. v2: add comment about the rename (David Lechner) Cc: David Lechner Cc: Vandita Kulkarni Reviewed-by: Thierry Reding Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20191028150047.22048-4-jani.nikula@intel.com

drm/dsi: add missing DSI DCS commands

2019-11-07T12:59:41+00:00

Update from the DCS specification. Cc: Vandita Kulkarni Reviewed-by: Thierry Reding Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20191028150047.22048-3-jani.nikula@intel.com