From 8423895d456672736a278d64f86d8b434eef2b54 Mon Sep 17 00:00:00 2001 From: Niklas Schnelle Date: Tue, 14 May 2024 15:08:58 +0200 Subject: [PATCH 01/15] video: Handle HAS_IOPORT dependencies In a future patch HAS_IOPORT=n will disable inb()/outb() and friends at compile time. We thus need to #ifdef functions and their callsites which unconditionally use these I/O accessors. In the include/video/vga.h these are conveniently all those functions with the vga_io_* prefix. Co-developed-by: Arnd Bergmann Signed-off-by: Arnd Bergmann Signed-off-by: Niklas Schnelle Signed-off-by: Helge Deller --- include/video/vga.h | 58 ++++++++++++++++++++++++++++++++------------- 1 file changed, 42 insertions(+), 16 deletions(-) diff --git a/include/video/vga.h b/include/video/vga.h index 947c0abd04ef..468764d6727a 100644 --- a/include/video/vga.h +++ b/include/video/vga.h @@ -197,9 +197,26 @@ struct vgastate { extern int save_vga(struct vgastate *state); extern int restore_vga(struct vgastate *state); +static inline unsigned char vga_mm_r (void __iomem *regbase, unsigned short port) +{ + return readb (regbase + port); +} + +static inline void vga_mm_w (void __iomem *regbase, unsigned short port, unsigned char val) +{ + writeb (val, regbase + port); +} + +static inline void vga_mm_w_fast (void __iomem *regbase, unsigned short port, + unsigned char reg, unsigned char val) +{ + writew (VGA_OUT16VAL (val, reg), regbase + port); +} + /* * generic VGA port read/write */ +#ifdef CONFIG_HAS_IOPORT static inline unsigned char vga_io_r (unsigned short port) { @@ -217,22 +234,6 @@ static inline void vga_io_w_fast (unsigned short port, unsigned char reg, outw(VGA_OUT16VAL (val, reg), port); } -static inline unsigned char vga_mm_r (void __iomem *regbase, unsigned short port) -{ - return readb (regbase + port); -} - -static inline void vga_mm_w (void __iomem *regbase, unsigned short port, unsigned char val) -{ - writeb (val, regbase + port); -} - -static inline void vga_mm_w_fast (void __iomem *regbase, unsigned short port, - unsigned char reg, unsigned char val) -{ - writew (VGA_OUT16VAL (val, reg), regbase + port); -} - static inline unsigned char vga_r (void __iomem *regbase, unsigned short port) { if (regbase) @@ -258,7 +259,24 @@ static inline void vga_w_fast (void __iomem *regbase, unsigned short port, else vga_io_w_fast (port, reg, val); } +#else /* CONFIG_HAS_IOPORT */ +static inline unsigned char vga_r (void __iomem *regbase, unsigned short port) +{ + return vga_mm_r (regbase, port); +} +static inline void vga_w (void __iomem *regbase, unsigned short port, unsigned char val) +{ + vga_mm_w (regbase, port, val); +} + + +static inline void vga_w_fast (void __iomem *regbase, unsigned short port, + unsigned char reg, unsigned char val) +{ + vga_mm_w_fast (regbase, port, reg, val); +} +#endif /* CONFIG_HAS_IOPORT */ /* * VGA CRTC register read/write @@ -280,6 +298,7 @@ static inline void vga_wcrt (void __iomem *regbase, unsigned char reg, unsigned #endif /* VGA_OUTW_WRITE */ } +#ifdef CONFIG_HAS_IOPORT static inline unsigned char vga_io_rcrt (unsigned char reg) { vga_io_w (VGA_CRT_IC, reg); @@ -295,6 +314,7 @@ static inline void vga_io_wcrt (unsigned char reg, unsigned char val) vga_io_w (VGA_CRT_DC, val); #endif /* VGA_OUTW_WRITE */ } +#endif /* CONFIG_HAS_IOPORT */ static inline unsigned char vga_mm_rcrt (void __iomem *regbase, unsigned char reg) { @@ -333,6 +353,7 @@ static inline void vga_wseq (void __iomem *regbase, unsigned char reg, unsigned #endif /* VGA_OUTW_WRITE */ } +#ifdef CONFIG_HAS_IOPORT static inline unsigned char vga_io_rseq (unsigned char reg) { vga_io_w (VGA_SEQ_I, reg); @@ -348,6 +369,7 @@ static inline void vga_io_wseq (unsigned char reg, unsigned char val) vga_io_w (VGA_SEQ_D, val); #endif /* VGA_OUTW_WRITE */ } +#endif /* CONFIG_HAS_IOPORT */ static inline unsigned char vga_mm_rseq (void __iomem *regbase, unsigned char reg) { @@ -385,6 +407,7 @@ static inline void vga_wgfx (void __iomem *regbase, unsigned char reg, unsigned #endif /* VGA_OUTW_WRITE */ } +#ifdef CONFIG_HAS_IOPORT static inline unsigned char vga_io_rgfx (unsigned char reg) { vga_io_w (VGA_GFX_I, reg); @@ -400,6 +423,7 @@ static inline void vga_io_wgfx (unsigned char reg, unsigned char val) vga_io_w (VGA_GFX_D, val); #endif /* VGA_OUTW_WRITE */ } +#endif /* CONFIG_HAS_IOPORT */ static inline unsigned char vga_mm_rgfx (void __iomem *regbase, unsigned char reg) { @@ -434,6 +458,7 @@ static inline void vga_wattr (void __iomem *regbase, unsigned char reg, unsigned vga_w (regbase, VGA_ATT_W, val); } +#ifdef CONFIG_HAS_IOPORT static inline unsigned char vga_io_rattr (unsigned char reg) { vga_io_w (VGA_ATT_IW, reg); @@ -445,6 +470,7 @@ static inline void vga_io_wattr (unsigned char reg, unsigned char val) vga_io_w (VGA_ATT_IW, reg); vga_io_w (VGA_ATT_W, val); } +#endif /* CONFIG_HAS_IOPORT */ static inline unsigned char vga_mm_rattr (void __iomem *regbase, unsigned char reg) { From aa578e897520f32ae12bec487f2474357d01ca9c Mon Sep 17 00:00:00 2001 From: Christophe JAILLET Date: Thu, 1 Aug 2024 22:34:39 +0200 Subject: [PATCH 02/15] fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() If an error occurs after request_mem_region(), a corresponding release_mem_region() should be called, as already done in the remove function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Christophe JAILLET Signed-off-by: Helge Deller --- drivers/video/fbdev/hpfb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/hpfb.c b/drivers/video/fbdev/hpfb.c index 66fac8e5393e..a1144b150982 100644 --- a/drivers/video/fbdev/hpfb.c +++ b/drivers/video/fbdev/hpfb.c @@ -345,6 +345,7 @@ static int hpfb_dio_probe(struct dio_dev *d, const struct dio_device_id *ent) if (hpfb_init_one(paddr, vaddr)) { if (d->scode >= DIOII_SCBASE) iounmap((void *)vaddr); + release_mem_region(d->resource.start, resource_size(&d->resource)); return -ENOMEM; } return 0; From 5ee70bec7945827c4661b9d44b094aac352dbaa8 Mon Sep 17 00:00:00 2001 From: ying zuxin Date: Fri, 23 Aug 2024 20:29:57 +0800 Subject: [PATCH 03/15] fbdev: mmp: Use devm_clk_get_enabled() helpers The devm_clk_get_enabled() helpers: - call devm_clk_get() - call clk_prepare_enable() and register what is needed in order to call clk_disable_unprepare() when needed, as a managed resource. This simplifies the code and avoids the calls to clk_disable_unprepare(). Signed-off-by: ying zuxin Signed-off-by: Helge Deller --- drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c index a20a2c408127..03e23173198c 100644 --- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c +++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c @@ -512,16 +512,13 @@ static int mmphw_probe(struct platform_device *pdev) } /* get clock */ - ctrl->clk = devm_clk_get(ctrl->dev, mi->clk_name); + ctrl->clk = devm_clk_get_enabled(ctrl->dev, mi->clk_name); if (IS_ERR(ctrl->clk)) { ret = PTR_ERR(ctrl->clk); dev_err_probe(ctrl->dev, ret, "unable to get clk %s\n", mi->clk_name); goto failed; } - ret = clk_prepare_enable(ctrl->clk); - if (ret) - goto failed; /* init global regs */ ctrl_set_default(ctrl); @@ -556,7 +553,6 @@ failed_path_init: path_deinit(path_plat); } - clk_disable_unprepare(ctrl->clk); failed: dev_err(&pdev->dev, "device init failed\n"); From 33ae421ad2b546e472e36d73cf13f2b3b386f713 Mon Sep 17 00:00:00 2001 From: Christophe JAILLET Date: Thu, 8 Aug 2024 11:46:11 +0200 Subject: [PATCH 04/15] fbdev: omapfb: panel-sony-acx565akm: Simplify show_cabc_available_modes() Use sysfs_emit_at() instead of snprintf() + custom logic. Using sysfs_emit_at() is much more simple. Also, sysfs_emit() is already used in this function, so using sysfs_emit_at() is more consistent. Also simplify the logic: - always add a space after an entry - change the last space into a '\n' Finally it is easy to see that, given the size of cabc_modes, PAGE_SIZE can not be reached. So better keep everything simple (and correct). Signed-off-by: Christophe JAILLET Reviewed-by: Andi Shyti Signed-off-by: Helge Deller --- .../omap2/omapfb/displays/panel-sony-acx565akm.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c index 71d2e015960c..fc975615d5c9 100644 --- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c +++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c @@ -466,19 +466,20 @@ static ssize_t show_cabc_available_modes(struct device *dev, char *buf) { struct panel_drv_data *ddata = dev_get_drvdata(dev); - int len; + int len = 0; int i; if (!ddata->has_cabc) return sysfs_emit(buf, "%s\n", cabc_modes[0]); - for (i = 0, len = 0; - len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++) - len += snprintf(&buf[len], PAGE_SIZE - len, "%s%s%s", - i ? " " : "", cabc_modes[i], - i == ARRAY_SIZE(cabc_modes) - 1 ? "\n" : ""); + for (i = 0; i < ARRAY_SIZE(cabc_modes); i++) + len += sysfs_emit_at(buf, len, "%s ", cabc_modes[i]); - return len < PAGE_SIZE ? len : PAGE_SIZE - 1; + /* Remove the trailing space */ + if (len) + buf[len - 1] = '\n'; + + return len; } static DEVICE_ATTR(cabc_mode, S_IRUGO | S_IWUSR, From 2451a285ee5e8c83bedcee7f4962c828b890becf Mon Sep 17 00:00:00 2001 From: Christophe JAILLET Date: Thu, 8 Aug 2024 14:14:22 +0200 Subject: [PATCH 05/15] fbdev: omapfb: Use sysfs_emit_at() to simplify code This file already uses sysfs_emit(). So be consistent and also use sysfs_emit_at(). Moreover, size is always < PAGE_SIZE because scnprintf() (and now sysfs_emit_at()) returns the number of characters written not including the trailing '\0'. So some tests can be removed. This slightly simplifies the code and makes it more readable. Signed-off-by: Christophe JAILLET Reviewed-by: Andi Shyti Signed-off-by: Helge Deller --- drivers/video/fbdev/omap/omapfb_main.c | 36 ++++++++++---------------- 1 file changed, 14 insertions(+), 22 deletions(-) diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c index aa31c0d26e92..e12c6019a4d6 100644 --- a/drivers/video/fbdev/omap/omapfb_main.c +++ b/drivers/video/fbdev/omap/omapfb_main.c @@ -1241,14 +1241,13 @@ static ssize_t omapfb_show_caps_num(struct device *dev, { struct omapfb_device *fbdev = dev_get_drvdata(dev); int plane; - size_t size; + size_t size = 0; struct omapfb_caps caps; plane = 0; - size = 0; - while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) { + while (plane < OMAPFB_PLANE_NUM) { omapfb_get_caps(fbdev, plane, &caps); - size += scnprintf(&buf[size], PAGE_SIZE - size, + size += sysfs_emit_at(buf, size, "plane#%d %#010x %#010x %#010x\n", plane, caps.ctrl, caps.plane_color, caps.wnd_color); plane++; @@ -1263,34 +1262,27 @@ static ssize_t omapfb_show_caps_text(struct device *dev, int i; struct omapfb_caps caps; int plane; - size_t size; + size_t size = 0; plane = 0; - size = 0; - while (size < PAGE_SIZE && plane < OMAPFB_PLANE_NUM) { + while (plane < OMAPFB_PLANE_NUM) { omapfb_get_caps(fbdev, plane, &caps); - size += scnprintf(&buf[size], PAGE_SIZE - size, - "plane#%d:\n", plane); - for (i = 0; i < ARRAY_SIZE(ctrl_caps) && - size < PAGE_SIZE; i++) { + size += sysfs_emit_at(buf, size, "plane#%d:\n", plane); + for (i = 0; i < ARRAY_SIZE(ctrl_caps); i++) { if (ctrl_caps[i].flag & caps.ctrl) - size += scnprintf(&buf[size], PAGE_SIZE - size, + size += sysfs_emit_at(buf, size, " %s\n", ctrl_caps[i].name); } - size += scnprintf(&buf[size], PAGE_SIZE - size, - " plane colors:\n"); - for (i = 0; i < ARRAY_SIZE(color_caps) && - size < PAGE_SIZE; i++) { + size += sysfs_emit_at(buf, size, " plane colors:\n"); + for (i = 0; i < ARRAY_SIZE(color_caps); i++) { if (color_caps[i].flag & caps.plane_color) - size += scnprintf(&buf[size], PAGE_SIZE - size, + size += sysfs_emit_at(buf, size, " %s\n", color_caps[i].name); } - size += scnprintf(&buf[size], PAGE_SIZE - size, - " window colors:\n"); - for (i = 0; i < ARRAY_SIZE(color_caps) && - size < PAGE_SIZE; i++) { + size += sysfs_emit_at(buf, size, " window colors:\n"); + for (i = 0; i < ARRAY_SIZE(color_caps); i++) { if (color_caps[i].flag & caps.wnd_color) - size += scnprintf(&buf[size], PAGE_SIZE - size, + size += sysfs_emit_at(buf, size, " %s\n", color_caps[i].name); } From 929c81ade6355b87097a2a4886c10750e68626cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Fri, 30 Aug 2024 11:45:57 +0200 Subject: [PATCH 06/15] fbdev: Introduce devm_register_framebuffer() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce a device-managed variant of register_framebuffer() which automatically unregisters the framebuffer on device destruction. This can simplify the error handling and resource management in drivers. Signed-off-by: Thomas Weißschuh Signed-off-by: Helge Deller --- drivers/video/fbdev/core/fbmem.c | 30 ++++++++++++++++++++++++++++++ include/linux/fb.h | 1 + 2 files changed, 31 insertions(+) diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index 4c4ad0a86a50..3c568cff2913 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -544,6 +544,36 @@ unregister_framebuffer(struct fb_info *fb_info) } EXPORT_SYMBOL(unregister_framebuffer); +static void devm_unregister_framebuffer(void *data) +{ + struct fb_info *info = data; + + unregister_framebuffer(info); +} + +/** + * devm_register_framebuffer - resource-managed frame buffer device registration + * @dev: device the framebuffer belongs to + * @fb_info: frame buffer info structure + * + * Registers a frame buffer device @fb_info to device @dev. + * + * Returns negative errno on error, or zero for success. + * + */ +int +devm_register_framebuffer(struct device *dev, struct fb_info *fb_info) +{ + int ret; + + ret = register_framebuffer(fb_info); + if (ret) + return ret; + + return devm_add_action_or_reset(dev, devm_unregister_framebuffer, fb_info); +} +EXPORT_SYMBOL(devm_register_framebuffer); + /** * fb_set_suspend - low level driver signals suspend * @info: framebuffer affected diff --git a/include/linux/fb.h b/include/linux/fb.h index db7d97b10964..abf6643ebcaf 100644 --- a/include/linux/fb.h +++ b/include/linux/fb.h @@ -601,6 +601,7 @@ extern ssize_t fb_sys_write(struct fb_info *info, const char __user *buf, /* fbmem.c */ extern int register_framebuffer(struct fb_info *fb_info); extern void unregister_framebuffer(struct fb_info *fb_info); +extern int devm_register_framebuffer(struct device *dev, struct fb_info *fb_info); extern char* fb_get_buffer_offset(struct fb_info *info, struct fb_pixmap *buf, u32 size); extern void fb_pad_unaligned_buffer(u8 *dst, u32 d_pitch, u8 *src, u32 idx, u32 height, u32 shift_high, u32 shift_low, u32 mod); From 95cdd538e0e5677efbdf8aade04ec098ab98f457 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 27 Aug 2024 17:25:13 +0200 Subject: [PATCH 07/15] fbdev: efifb: Register sysfs groups through driver core MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup. Also avoid a UAF race during unregistering where the sysctl attributes were usable after the info struct was freed. Signed-off-by: Thomas Weißschuh Signed-off-by: Helge Deller --- drivers/video/fbdev/efifb.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c index 8dd82afb3452..595b8e27bea6 100644 --- a/drivers/video/fbdev/efifb.c +++ b/drivers/video/fbdev/efifb.c @@ -561,15 +561,10 @@ static int efifb_probe(struct platform_device *dev) break; } - err = sysfs_create_groups(&dev->dev.kobj, efifb_groups); - if (err) { - pr_err("efifb: cannot add sysfs attrs\n"); - goto err_unmap; - } err = fb_alloc_cmap(&info->cmap, 256, 0); if (err < 0) { pr_err("efifb: cannot allocate colormap\n"); - goto err_groups; + goto err_unmap; } err = devm_aperture_acquire_for_platform_device(dev, par->base, par->size); @@ -587,8 +582,6 @@ static int efifb_probe(struct platform_device *dev) err_fb_dealloc_cmap: fb_dealloc_cmap(&info->cmap); -err_groups: - sysfs_remove_groups(&dev->dev.kobj, efifb_groups); err_unmap: if (mem_flags & (EFI_MEMORY_UC | EFI_MEMORY_WC)) iounmap(info->screen_base); @@ -608,12 +601,12 @@ static void efifb_remove(struct platform_device *pdev) /* efifb_destroy takes care of info cleanup */ unregister_framebuffer(info); - sysfs_remove_groups(&pdev->dev.kobj, efifb_groups); } static struct platform_driver efifb_driver = { .driver = { .name = "efi-framebuffer", + .dev_groups = efifb_groups, }, .probe = efifb_probe, .remove_new = efifb_remove, From 077091721af00d2a9212218c2d61acbac5f47630 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 27 Aug 2024 17:25:15 +0200 Subject: [PATCH 08/15] fbdev: efifb: Use devm_register_framebuffer() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This simplifies the error handling. Also the drvdata slot is now unused and can be used for other usecases. Signed-off-by: Thomas Weißschuh Signed-off-by: Helge Deller --- drivers/video/fbdev/efifb.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c index 595b8e27bea6..ee71a65b361d 100644 --- a/drivers/video/fbdev/efifb.c +++ b/drivers/video/fbdev/efifb.c @@ -449,7 +449,6 @@ static int efifb_probe(struct platform_device *dev) err = -ENOMEM; goto err_release_mem; } - platform_set_drvdata(dev, info); par = info->par; info->pseudo_palette = par->pseudo_palette; @@ -572,7 +571,7 @@ static int efifb_probe(struct platform_device *dev) pr_err("efifb: cannot acquire aperture\n"); goto err_fb_dealloc_cmap; } - err = register_framebuffer(info); + err = devm_register_framebuffer(&dev->dev, info); if (err < 0) { pr_err("efifb: cannot register framebuffer\n"); goto err_fb_dealloc_cmap; @@ -595,21 +594,12 @@ err_release_mem: return err; } -static void efifb_remove(struct platform_device *pdev) -{ - struct fb_info *info = platform_get_drvdata(pdev); - - /* efifb_destroy takes care of info cleanup */ - unregister_framebuffer(info); -} - static struct platform_driver efifb_driver = { .driver = { .name = "efi-framebuffer", .dev_groups = efifb_groups, }, .probe = efifb_probe, - .remove_new = efifb_remove, }; builtin_platform_driver(efifb_driver); From bd97615a331684590f6fe65420e9a959a57c975b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Date: Tue, 27 Aug 2024 17:25:16 +0200 Subject: [PATCH 09/15] fbdev: efifb: Use driver-private screen_info for sysfs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since commit b9cfd1d271ab ("fbdev/efifb: Use screen_info pointer from device") efifb uses a local copy of screen_info and applies its modifications there. Adapt the sysfs attributes to also work with the custom copy instead of the unmodified platform data. Signed-off-by: Thomas Weißschuh Signed-off-by: Helge Deller --- drivers/video/fbdev/efifb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c index ee71a65b361d..20517448487e 100644 --- a/drivers/video/fbdev/efifb.c +++ b/drivers/video/fbdev/efifb.c @@ -322,7 +322,7 @@ static ssize_t name##_show(struct device *dev, \ struct device_attribute *attr, \ char *buf) \ { \ - struct screen_info *si = dev_get_platdata(dev); \ + struct screen_info *si = dev_get_drvdata(dev); \ if (!si) \ return -ENODEV; \ return sprintf(buf, fmt "\n", (si->lfb_##name)); \ @@ -369,6 +369,8 @@ static int efifb_probe(struct platform_device *dev) if (!si) return -ENOMEM; + dev_set_drvdata(&dev->dev, si); + if (si->orig_video_isVGA != VIDEO_TYPE_EFI) return -ENODEV; From 2ff86df2b6a3b535b9cd4f3a9a37f5e181d3a898 Mon Sep 17 00:00:00 2001 From: Chen Ni Date: Mon, 2 Sep 2024 15:57:24 +0800 Subject: [PATCH 10/15] fbdev: pxa3xx-gcu: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Signed-off-by: Helge Deller --- drivers/video/fbdev/pxa3xx-gcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c index 43c80316d84b..489088b4e467 100644 --- a/drivers/video/fbdev/pxa3xx-gcu.c +++ b/drivers/video/fbdev/pxa3xx-gcu.c @@ -594,8 +594,8 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev) * container_of(). This isn't really necessary as we have a fixed minor * number anyway, but this is to avoid statics. */ - priv->misc_dev.minor = PXA3XX_GCU_MINOR, - priv->misc_dev.name = DRV_NAME, + priv->misc_dev.minor = PXA3XX_GCU_MINOR; + priv->misc_dev.name = DRV_NAME; priv->misc_dev.fops = &pxa3xx_gcu_miscdev_fops; /* handle IO resources */ From 18b0327310efa286e1bf8fca3845cf2d121d36f1 Mon Sep 17 00:00:00 2001 From: Chen Ni Date: Mon, 2 Sep 2024 16:47:30 +0800 Subject: [PATCH 11/15] fbdev: imsttfb: convert comma to semicolon Replace a comma between expression statements by a semicolon. Signed-off-by: Chen Ni Signed-off-by: Helge Deller --- drivers/video/fbdev/imsttfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c index 660499260f46..dc4e659e06af 100644 --- a/drivers/video/fbdev/imsttfb.c +++ b/drivers/video/fbdev/imsttfb.c @@ -995,7 +995,7 @@ imsttfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) bgc |= (bgc << 8); bgc |= (bgc << 16); - Bpp = info->var.bits_per_pixel >> 3, + Bpp = info->var.bits_per_pixel >> 3; line_pitch = info->fix.line_length; dy = rect->dy * line_pitch; @@ -1036,7 +1036,7 @@ imsttfb_copyarea(struct fb_info *info, const struct fb_copyarea *area) __u32 Bpp, line_pitch, fb_offset_old, fb_offset_new, sp, dp_octl; __u32 cnt, bltctl, sx, sy, dx, dy, height, width; - Bpp = info->var.bits_per_pixel >> 3, + Bpp = info->var.bits_per_pixel >> 3; sx = area->sx * Bpp; sy = area->sy; From 27f22f897095b09df32bf689b63624d23b0c8ebc Mon Sep 17 00:00:00 2001 From: Chen Ni Date: Mon, 2 Sep 2024 15:44:02 +0800 Subject: [PATCH 12/15] fbdev: hyperv_fb: Convert comma to semicolon Replace a comma between expression statements by a semicolon. Fixes: d786e00d19f9 ("drivers: hv, hyperv_fb: Untangle and refactor Hyper-V panic notifiers") Signed-off-by: Chen Ni Signed-off-by: Helge Deller --- drivers/video/fbdev/hyperv_fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c index 8fdccf033b2d..7fdb5edd7e2e 100644 --- a/drivers/video/fbdev/hyperv_fb.c +++ b/drivers/video/fbdev/hyperv_fb.c @@ -1189,7 +1189,7 @@ static int hvfb_probe(struct hv_device *hdev, * which is almost at the end of list, with priority = INT_MIN + 1. */ par->hvfb_panic_nb.notifier_call = hvfb_on_panic; - par->hvfb_panic_nb.priority = INT_MIN + 10, + par->hvfb_panic_nb.priority = INT_MIN + 10; atomic_notifier_chain_register(&panic_notifier_list, &par->hvfb_panic_nb); From c2af2a45560bd4046c2e109152acde029ed0acc2 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Mon, 9 Sep 2024 22:09:16 -0400 Subject: [PATCH 13/15] fbdev: xen-fbfront: Assign fb_info->device MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Probing xen-fbfront faults in video_is_primary_device(). The passed-in struct device is NULL since xen-fbfront doesn't assign it and the memory is kzalloc()-ed. Assign fb_info->device to avoid this. This was exposed by the conversion of fb_is_primary_device() to video_is_primary_device() which dropped a NULL check for struct device. Fixes: f178e96de7f0 ("arch: Remove struct fb_info from video helpers") Reported-by: Arthur Borsboom Closes: https://lore.kernel.org/xen-devel/CALUcmUncX=LkXWeiSiTKsDY-cOe8QksWhFvcCneOKfrKd0ZajA@mail.gmail.com/ Tested-by: Arthur Borsboom CC: stable@vger.kernel.org Signed-off-by: Jason Andryuk Reviewed-by: Roger Pau Monné Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/xen-fbfront.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c index 66d4628a96ae..c90f48ebb15e 100644 --- a/drivers/video/fbdev/xen-fbfront.c +++ b/drivers/video/fbdev/xen-fbfront.c @@ -407,6 +407,7 @@ static int xenfb_probe(struct xenbus_device *dev, /* complete the abuse: */ fb_info->pseudo_palette = fb_info->par; fb_info->par = info; + fb_info->device = &dev->dev; fb_info->screen_buffer = info->fb; From 4a6921095eb04a900e0000da83d9475eb958e61e Mon Sep 17 00:00:00 2001 From: Kaixin Wang Date: Wed, 11 Sep 2024 22:29:52 +0800 Subject: [PATCH 14/15] fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime. Signed-off-by: Kaixin Wang Signed-off-by: Helge Deller --- drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c index 2ef56fa28aff..5ce02495cda6 100644 --- a/drivers/video/fbdev/pxafb.c +++ b/drivers/video/fbdev/pxafb.c @@ -2403,6 +2403,7 @@ static void pxafb_remove(struct platform_device *dev) info = &fbi->fb; pxafb_overlay_exit(fbi); + cancel_work_sync(&fbi->task); unregister_framebuffer(info); pxafb_disable_controller(fbi); From de5e89b6654ea0b021a5737e0f55fc6bed625550 Mon Sep 17 00:00:00 2001 From: Andrew Kreimer Date: Wed, 11 Sep 2024 21:24:37 +0300 Subject: [PATCH 15/15] fbdev: omapfb: Fix typo in comment Reported-by: Matthew Wilcox Signed-off-by: Andrew Kreimer Signed-off-by: Helge Deller --- drivers/video/fbdev/omap2/omapfb/dss/hdmi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi.h b/drivers/video/fbdev/omap2/omapfb/dss/hdmi.h index 9a7253355f6d..cdb1dedca492 100644 --- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi.h +++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi.h @@ -351,7 +351,7 @@ struct omap_hdmi { bool audio_configured; struct omap_dss_audio audio_config; - /* This lock should be taken when booleans bellow are touched. */ + /* This lock should be taken when booleans below are touched. */ spinlock_t audio_playing_lock; bool audio_playing; bool display_enabled;