linux/drivers/video/fbdev/omap2, branch v5.0

Merge tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux

2019-01-18T17:43:05Z

Pull fbdev fixes from Bartlomiej Zolnierkiewicz: - fix stack memory leak in omap2fb driver (Vlad Tsyrklevich) - fix OF node name handling v4.20 regression in offb driver (Rob Herring) - convert CONFIG_FB_LOGO_CENTER config option added in v5.0-rc1 into a kernel parameter (Peter Rosin) * tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux: fbdev: fbmem: convert CONFIG_FB_LOGO_CENTER into a cmd line option fbdev: offb: Fix OF node name handling omap2fb: Fix stack memory disclosure

omap2fb: Fix stack memory disclosure

2019-01-11T13:34:38Z

Using [1] for static analysis I found that the OMAPFB_QUERY_PLANE, OMAPFB_GET_COLOR_KEY, OMAPFB_GET_DISPLAY_INFO, and OMAPFB_GET_VRAM_INFO cases could all leak uninitialized stack memory--either due to uninitialized padding or 'reserved' fields. Fix them by clearing the shared union used to store copied out data. [1] https://github.com/vlad902/kernel-uninitialized-memory-checker Signed-off-by: Vlad Tsyrklevich Reviewed-by: Kees Cook Fixes: b39a982ddecf ("OMAP: DSS2: omapfb driver") Cc: security@kernel.org [b.zolnierkie: prefix patch subject with "omap2fb: "] Signed-off-by: Bartlomiej Zolnierkiewicz

Merge tag 'fbdev-v4.21' of git://github.com/bzolnier/linux

2019-01-06T02:15:37Z

Pull fbdev updates from Bartlomiej Zolnierkiewicz: "This time the pull request is really small. The most notable changes are fixing fbcon to not cause crash on unregister_framebuffer() operation when there is more than one framebuffer, adding config option to center the bootup logo and making FB_BACKLIGHT config option tristate (which in turn uncovered incorrect FB_BACKLIGHT usage by DRM's nouveau driver). Summary: - fix fbcon to not cause crash on unregister_framebuffer() when there is more than one framebuffer (Noralf Trønnes) - improve support for small rotated displays (Peter Rosin) - fix probe failure handling in udlfb driver (Dan Carpenter) - add config option to center the bootup logo (Peter Rosin) - make FB_BACKLIGHT config option tristate (Rob Clark) - remove superfluous HAS_DMA dependency for goldfishfb driver (Geert Uytterhoeven) - misc fixes (Alexey Khoroshilov, YueHaibing, Colin Ian King, Lubomir Rintel) - misc cleanups (Yangtao Li, Wen Yang) also there is DRM's nouveau driver fix for wrong FB_BACKLIGHT config option usage (FB_BACKLIGHT is for internal fbdev subsystem use only)" * tag 'fbdev-v4.21' of git://github.com/bzolnier/linux: drm/nouveau: fix incorrect FB_BACKLIGHT usage in Kconfig fbdev: fbcon: Fix unregister crash when more than one framebuffer fbdev: Remove depends on HAS_DMA in case of platform dependency pxa168fb: trivial typo fix fbdev: fsl-diu: remove redundant null check on cmap fbdev: omap2: omapfb: convert to DEFINE_SHOW_ATTRIBUTE fbdev: uvesafb: fix spelling mistake "memoery" -> "memory" fbdev: fbmem: add config option to center the bootup logo fbdev: fbmem: make fb_show_logo_line return the end instead of the height video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data" fbdev: fbmem: behave better with small rotated displays and many CPUs video: clps711x-fb: release disp device node in probe() fbdev: make FB_BACKLIGHT a tristate udlfb: fix some inconsistent NULL checking

Remove 'type' argument from access_ok() function

2019-01-04T02:57:57Z

Nobody has actually used the type (VERIFY_READ vs VERIFY_WRITE) argument of the user address range verification function since we got rid of the old racy i386-only code to walk page tables by hand. It existed because the original 80386 would not honor the write protect bit when in kernel mode, so you had to do COW by hand before doing any user access. But we haven't supported that in a long time, and these days the 'type' argument is a purely historical artifact. A discussion about extending 'user_access_begin()' to do the range checking resulted this patch, because there is no way we're going to move the old VERIFY_xyz interface to that model. And it's best done at the end of the merge window when I've done most of my merges, so let's just get this done once and for all. This patch was mostly done with a sed-script, with manual fix-ups for the cases that weren't of the trivial 'access_ok(VERIFY_xyz' form. There were a couple of notable cases: - csky still had the old "verify_area()" name as an alias. - the iter_iov code had magical hardcoded knowledge of the actual values of VERIFY_{READ,WRITE} (not that they mattered, since nothing really used it) - microblaze used the type argument for a debug printout but other than those oddities this should be a total no-op patch. I tried to fix up all architectures, did fairly extensive grepping for access_ok() uses, and the changes are trivial, but I may have missed something. Any missed conversion should be trivially fixable, though. Signed-off-by: Linus Torvalds

fbdev: omap2: omapfb: convert to DEFINE_SHOW_ATTRIBUTE

2018-12-20T18:13:08Z

Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Cc: Fengguang Wu Cc: Mauro Carvalho Chehab Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: remove redundant 'default n' from Kconfig-s

2018-10-24T09:26:32Z

'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Acked-by: Randy Dunlap Signed-off-by: Bartlomiej Zolnierkiewicz

fbdev/omapfb: fix omapfb_memory_read infoleak

2018-09-26T16:11:22Z

OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies them to a userspace buffer. The code has two issues: - The user provided width and height could be large enough to overflow the calculations - The copy_to_user() can copy uninitialized memory to the userspace, which might contain sensitive kernel information. Fix these by limiting the width & height parameters, and only copying the amount of data that we actually received from the LCD. Signed-off-by: Tomi Valkeinen Reported-by: Jann Horn Cc: stable@vger.kernel.org Cc: security@kernel.org Cc: Will Deacon Cc: Jann Horn Cc: Tony Lindgren Signed-off-by: Bartlomiej Zolnierkiewicz

Merge tag 'fbdev-v4.19' of https://github.com/bzolnier/linux

2018-08-23T22:44:58Z

Pull fbdev updates from Bartlomiej Zolnierkiewicz: "Mostly small fixes and cleanups for fb drivers (the biggest updates are for udlfb and pxafb drivers). This also adds deferred console takeover support to the console code and efifb driver. Summary: - add support for deferred console takeover, when enabled defers fbcon taking over the console from the dummy console until the first text is displayed on the console - together with the "quiet" kernel commandline option this allows fbcon to still be used together with a smooth graphical bootup (Hans de Goede) - improve console locking debugging code (Thomas Zimmermann) - copy the ACPI BGRT boot graphics to the framebuffer when deferred console takeover support is used in efifb driver (Hans de Goede) - update udlfb driver - fix lost console when the user unplugs a USB adapter, fix the screen corruption issue, fix locking and add some performance optimizations (Mikulas Patocka) - update pxafb driver - fix using uninitialized memory, switch to devm_* API, handle initialization errors and add support for lcd-supply regulator (Daniel Mack) - add support for boards booted with a DeviceTree in pxa3xx_gcu driver (Daniel Mack) - rename omap2 module to omap2fb.ko to avoid conflicts with omap1 driver (Arnd Bergmann) - enable ACPI-based enumeration for goldfishfb driver (Yu Ning) - fix goldfishfb driver to make user space Android code use 60 fps (Christoffer Dall) - print big fat warning when nomodeset kernel parameter is used in vgacon driver (Lyude Paul) - remove VLA usage from fsl-diu-fb driver (Kees Cook) - misc fixes (Julia Lawall, Geert Uytterhoeven, Fredrik Noring, Yisheng Xie, Dan Carpenter, Daniel Vetter, Anton Vasilyev, Randy Dunlap, Gustavo A. R. Silva, Colin Ian King, Fengguang Wu) - misc cleanups (Roman Kiryanov, Yisheng Xie, Colin Ian King)" * tag 'fbdev-v4.19' of https://github.com/bzolnier/linux: (54 commits) Documentation/fb: corrections for fbcon.txt fbcon: Do not takeover the console from atomic context dummycon: Stop exporting dummycon_[un]register_output_notifier fbcon: Only defer console takeover if the current console driver is the dummycon fbcon: Only allow FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER if fbdev is builtin fbdev: omap2: omapfb: fix ifnullfree.cocci warnings fbdev: omap2: omapfb: fix bugon.cocci warnings fbdev: omap2: omapfb: fix boolreturn.cocci warnings fb: amifb: fix build warnings when not builtin fbdev/core: Disable console-lock warnings when fb.lockless_register_fb is set console: Replace #if 0 with atomic var 'ignore_console_lock_warning' udlfb: use spin_lock_irq instead of spin_lock_irqsave udlfb: avoid prefetch udlfb: optimization - test the backing buffer udlfb: allow reallocating the framebuffer udlfb: set line_length in dlfb_ops_set_par udlfb: handle allocation failure udlfb: set optimal write delay udlfb: make a local copy of fb_ops udlfb: don't switch if we are switching to the same videomode ...

Merge tag 'char-misc-4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2018-08-18T18:04:51Z

Pull char/misc driver updates from Greg KH: "Here is the bit set of char/misc drivers for 4.19-rc1 There is a lot here, much more than normal, seems like everyone is writing new driver subsystems these days... Anyway, major things here are: - new FSI driver subsystem, yet-another-powerpc low-level hardware bus - gnss, finally an in-kernel GPS subsystem to try to tame all of the crazy out-of-tree drivers that have been floating around for years, combined with some really hacky userspace implementations. This is only for GNSS receivers, but you have to start somewhere, and this is great to see. Other than that, there are new slimbus drivers, new coresight drivers, new fpga drivers, and loads of DT bindings for all of these and existing drivers. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (255 commits) android: binder: Rate-limit debug and userspace triggered err msgs fsi: sbefifo: Bump max command length fsi: scom: Fix NULL dereference misc: mic: SCIF Fix scif_get_new_port() error handling misc: cxl: changed asterisk position genwqe: card_base: Use true and false for boolean values misc: eeprom: assignment outside the if statement uio: potential double frees if __uio_register_device() fails eeprom: idt_89hpesx: clean up an error pointer vs NULL inconsistency misc: ti-st: Fix memory leak in the error path of probe() android: binder: Show extra_buffers_size in trace firmware: vpd: Fix section enabled flag on vpd_section_destroy platform: goldfish: Retire pdev_bus goldfish: Use dedicated macros instead of manual bit shifting goldfish: Add missing includes to goldfish.h mux: adgs1408: new driver for Analog Devices ADGS1408/1409 mux dt-bindings: mux: add adi,adgs1408 Drivers: hv: vmbus: Cleanup synic memory free path Drivers: hv: vmbus: Remove use of slow_virt_to_phys() Drivers: hv: vmbus: Reset the channel callback in vmbus_onoffer_rescind() ...

media: omap2: omapfb: fix bugon.cocci warnings

2018-08-02T23:01:38Z

drivers/video/fbdev/omap2/omapfb/dss/dss_features.c:895:2-5: WARNING: Use BUG_ON instead of if condition followed by BUG. Please make sure the condition has no side effects (see conditional BUG_ON definition in include/asm-generic/bug.h) Use BUG_ON instead of a if condition followed by BUG. Semantic patch information: This makes an effort to find cases where BUG() follows an if condition on an expression and replaces the if condition and BUG() with a BUG_ON having the conditional expression of the if statement as argument. Generated by: scripts/coccinelle/misc/bugon.cocci Signed-off-by: kbuild test robot Signed-off-by: Mauro Carvalho Chehab