Linux Framebuffer Layer development
 help / color / mirror / Atom feed
* Re: [PATCH v3] backlight: pm8941: Add NULL check in wled_configure()
From: Markus Elfring @ 2025-04-01  6:18 UTC (permalink / raw)
  To: Henry Martin, linux-fbdev, linux-arm-msm, dri-devel
  Cc: LKML, Daniel Thompson, Helge Deller, Jingoo Han, Lee Jones
In-Reply-To: <20250401025737.16753-1-bsdhenrymartin@gmail.com>

> devm_kasprintf() return NULL if memory allocation fails. Currently,
…
                call?                               failed?


> Add NULL check after devm_kasprintf() to prevent this issue.

Do you propose to improve this function implementation a bit more?

Regards,
Markus

^ permalink raw reply

* [PATCH v3] backlight: pm8941: Add NULL check in wled_configure()
From: Henry Martin @ 2025-04-01  2:57 UTC (permalink / raw)
  To: lee, danielt, jingoohan1, deller
  Cc: linux-arm-msm, dri-devel, linux-fbdev, linux-kernel, Henry Martin,
	Dmitry Baryshkov

devm_kasprintf() returns NULL when memory allocation fails. Currently,
wled_configure() does not check for this case, which results in a NULL
pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

Fixes: f86b77583d88 ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
V2 -> V3: Correct commit meessage and confirm this patch has considered
resource cleanup to avoid any subsequent issues, ensuring that errors
are handled properly and no resources are left in an inconsistent
state.
V1 -> V2: Fix commit message to use imperative mood and wrap lines to 75
characters.

 drivers/video/backlight/qcom-wled.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 9afe701b2a1b..a63bb42c8f8b 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1406,9 +1406,11 @@ static int wled_configure(struct wled *wled)
 	wled->ctrl_addr = be32_to_cpu(*prop_addr);
 
 	rc = of_property_read_string(dev->of_node, "label", &wled->name);
-	if (rc)
+	if (rc) {
 		wled->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);
-
+		if (!wled->name)
+			return -ENOMEM;
+	}
 	switch (wled->version) {
 	case 3:
 		u32_opts = wled3_opts;
-- 
2.34.1


^ permalink raw reply related

* Re: [PATCH v2] backlight: pm8941: Add NULL check in wled_configure()
From: Dmitry Baryshkov @ 2025-03-31 20:23 UTC (permalink / raw)
  To: Henry Martin
  Cc: lee, danielt, jingoohan1, deller, linux-arm-msm, dri-devel,
	linux-fbdev, linux-kernel
In-Reply-To: <20250331141654.12624-1-bsdhenrymartin@gmail.com>

On Mon, Mar 31, 2025 at 10:16:54PM +0800, Henry Martin wrote:
> devm_kasprintf() return NULL if memory allocation fails. Currently,
> wled_configure() does not check for this case, leading to a possible NULL
> pointer dereference.
> 
> Add NULL check after devm_kasprintf() to prevent this issue.
> 
> Fixes: f86b77583d88 ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
> V1 -> V2: Fix commit message to use imperative mood and wrap lines to 75
> characters.
> 
>  drivers/video/backlight/qcom-wled.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

-- 
With best wishes
Dmitry

^ permalink raw reply

* Re: [PATCH 1/1] fbdev: atyfb: Fix buffer overflow
From: Ville Syrjälä @ 2025-03-31 19:55 UTC (permalink / raw)
  To: Jani Nikula
  Cc: Denis Arefev, Helge Deller, Thomas Zimmermann, linux-fbdev,
	dri-devel, linux-kernel, lvc-project
In-Reply-To: <87pli26arh.fsf@intel.com>

On Thu, Mar 27, 2025 at 12:14:26PM +0200, Jani Nikula wrote:
> On Thu, 27 Mar 2025, Denis Arefev <arefev@swemel.ru> wrote:
> > The value LCD_MISC_CNTL is used in the 'aty_st_lcd()' function to
> > calculate an index for accessing an array element of size 9.
> > This may cause a buffer overflow.
> 
> The fix is to fix it, not silently brush it under the carpet.

There's actually nothing to fix. The backlight code is only
used on Rage Mobility which has real indexed LCD registers.

Older chips do supposedly have backlight control as well,
but implemented differently. I was mildly curious about
this stuff, so I I poked at my Rage LT Pro a bit to see
if I could get backlight control working on it, but the
only things I was able to achieve were either backlight
completely off, or blinking horribly. So looks like at least
on this machine (Dell Insipiron 7000) the backlight is
implemented in a way that can't be controller via the
normal registers. The machine does have brightness keys that
do work (though the difference between the min and max is
barely noticeable) but they don't result in any changes in
the relevant registers.

> 
> BR,
> Jani.
> 
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Signed-off-by: Denis Arefev <arefev@swemel.ru>
> > ---
> >  drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
> > index 210fd3ac18a4..93eb5eb6042b 100644
> > --- a/drivers/video/fbdev/aty/atyfb_base.c
> > +++ b/drivers/video/fbdev/aty/atyfb_base.c
> > @@ -149,6 +149,8 @@ static const u32 lt_lcd_regs[] = {
> >  void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
> >  {
> >  	if (M64_HAS(LT_LCD_REGS)) {
> > +		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
> > +			return;
> >  		aty_st_le32(lt_lcd_regs[index], val, par);
> >  	} else {
> >  		unsigned long temp;
> > @@ -164,6 +166,8 @@ void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
> >  u32 aty_ld_lcd(int index, const struct atyfb_par *par)
> >  {
> >  	if (M64_HAS(LT_LCD_REGS)) {
> > +		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
> > +			return 0;
> >  		return aty_ld_le32(lt_lcd_regs[index], par);
> >  	} else {
> >  		unsigned long temp;
> 
> -- 
> Jani Nikula, Intel

-- 
Ville Syrjälä
Intel

^ permalink raw reply

* Re: [PATCH v2] backlight: pm8941: Add NULL check in wled_configure()
From: Markus Elfring @ 2025-03-31 16:48 UTC (permalink / raw)
  To: Henry Martin, linux-fbdev, linux-arm-msm, dri-devel
  Cc: LKML, Daniel Thompson, Helge Deller, Jingoo Han, Lee Jones
In-Reply-To: <20250331141654.12624-1-bsdhenrymartin@gmail.com>

> devm_kasprintf() return NULL if memory allocation fails. Currently,

                 call?                               failed?


> wled_configure() does not check for this case, leading to a possible NULL
> pointer dereference.

You may omit the word “possible” in such a change description.
(Would questionable data processing happen in other function implementations?)


> Add NULL check after devm_kasprintf() to prevent this issue.

Do you complete the error/exception handling also with the statement “return -ENOMEM;”?

Regards,
Markus

^ permalink raw reply

* [PATCH v2] backlight: pm8941: Add NULL check in wled_configure()
From: Henry Martin @ 2025-03-31 14:16 UTC (permalink / raw)
  To: lee, danielt, jingoohan1, deller
  Cc: linux-arm-msm, dri-devel, linux-fbdev, linux-kernel, Henry Martin

devm_kasprintf() return NULL if memory allocation fails. Currently,
wled_configure() does not check for this case, leading to a possible NULL
pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

Fixes: f86b77583d88 ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
V1 -> V2: Fix commit message to use imperative mood and wrap lines to 75
characters.

 drivers/video/backlight/qcom-wled.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 9afe701b2a1b..a63bb42c8f8b 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1406,9 +1406,11 @@ static int wled_configure(struct wled *wled)
 	wled->ctrl_addr = be32_to_cpu(*prop_addr);
 
 	rc = of_property_read_string(dev->of_node, "label", &wled->name);
-	if (rc)
+	if (rc) {
 		wled->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);
-
+		if (!wled->name)
+			return -ENOMEM;
+	}
 	switch (wled->version) {
 	case 3:
 		u32_opts = wled3_opts;
-- 
2.34.1


^ permalink raw reply related

* Re: [PATCH] backlight: qcom-wled: Add NULL check in the wled_configure
From: Markus Elfring @ 2025-03-31 11:50 UTC (permalink / raw)
  To: Henry Martin, linux-fbdev, linux-arm-msm, dri-devel
  Cc: LKML, Daniel Thompson, Daniel Thompson, Helge Deller, Jingoo Han,
	Lee Jones
In-Reply-To: <20250331091245.6668-1-bsdhenrymartin@gmail.com>

> When devm_kasprintf() fails, it returns a NULL pointer. However, this return value is not properly checked in the function wled_configure.
>
> A NULL check should be added after the devm_kasprintf call to prevent potential NULL pointer dereference error.

* Please adhere to word wrapping preferences around 75 characters per text line.

* How do you think about to choose the imperative mood for an improved change description?
  https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.14#n94> +++ b/drivers/video/backlight/qcom-wled.c
> @@ -1406,8 +1406,14 @@ static int wled_configure(struct wled *wled)
>  	wled->ctrl_addr = be32_to_cpu(*prop_addr);
>
>  	rc = of_property_read_string(dev->of_node, "label", &wled->name);
> -	if (rc)
> +	if (rc) {
>  		wled->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);
> +		if (!wled->name) {
> +			dev_err(dev, "Failed to allocate memory for wled name\n");
> +			return -ENOMEM;
> +		}
> +	}
…

An extra error messages for a failed memory allocation may occasionally be omitted.

Regards,
Markus

^ permalink raw reply

* Re: [PATCH] backlight: qcom-wled: Add NULL check in the wled_configure
From: Daniel Thompson @ 2025-03-31 11:11 UTC (permalink / raw)
  To: Henry Martin
  Cc: lee, danielt, jingoohan1, deller, linux-arm-msm, dri-devel,
	linux-fbdev, linux-kernel
In-Reply-To: <20250331091245.6668-1-bsdhenrymartin@gmail.com>

On Mon, Mar 31, 2025 at 05:12:45PM +0800, Henry Martin wrote:
> When devm_kasprintf() fails, it returns a NULL pointer. However, this return value is not properly checked in the function wled_configure.
>
> A NULL check should be added after the devm_kasprintf call to prevent potential NULL pointer dereference error.
>
> Fixes: f86b77583d88c ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")
>
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  drivers/video/backlight/qcom-wled.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
> index 9afe701b2a1b..db5eda8ec37e 100644
> --- a/drivers/video/backlight/qcom-wled.c
> +++ b/drivers/video/backlight/qcom-wled.c
> @@ -1406,8 +1406,14 @@ static int wled_configure(struct wled *wled)
>  	wled->ctrl_addr = be32_to_cpu(*prop_addr);
>
>  	rc = of_property_read_string(dev->of_node, "label", &wled->name);
> -	if (rc)
> +	if (rc) {
>  		wled->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);
> +		if (!wled->name) {
> +			dev_err(dev, "Failed to allocate memory for wled name\n");
> +			return -ENOMEM;
> +		}
> +	}
> +

No objections to the check but I don't think it needs a dev_err(). It
is a waste of .text to store a string that is likely never to be
printed.


Daniel.

^ permalink raw reply

* [PATCH] backlight: qcom-wled: Add NULL check in the wled_configure
From: Henry Martin @ 2025-03-31  9:12 UTC (permalink / raw)
  To: lee, danielt, jingoohan1, deller
  Cc: linux-arm-msm, dri-devel, linux-fbdev, linux-kernel, Henry Martin

When devm_kasprintf() fails, it returns a NULL pointer. However, this return value is not properly checked in the function wled_configure.

A NULL check should be added after the devm_kasprintf call to prevent potential NULL pointer dereference error.

Fixes: f86b77583d88c ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")

Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 drivers/video/backlight/qcom-wled.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 9afe701b2a1b..db5eda8ec37e 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1406,8 +1406,14 @@ static int wled_configure(struct wled *wled)
 	wled->ctrl_addr = be32_to_cpu(*prop_addr);
 
 	rc = of_property_read_string(dev->of_node, "label", &wled->name);
-	if (rc)
+	if (rc) {
 		wled->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);
+		if (!wled->name) {
+			dev_err(dev, "Failed to allocate memory for wled name\n");
+			return -ENOMEM;
+		}
+	}
+
 
 	switch (wled->version) {
 	case 3:
-- 
2.34.1


^ permalink raw reply related

* [PATCH] staging: sm750fb: modify function name to kernel code style
From: Richard Akintola @ 2025-03-31  8:53 UTC (permalink / raw)
  To: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
	linux-kernel
  Cc: julia.lawall, princerichard17a

Change camelCase function name sii164ResetChip to sii164_reset_chip
as reported by checkpatch.pl

CHECK: Avoid camelCase: <sii164ResetChip>

Signed-off-by: Richard Akintola <princerichard17a@gmail.com>
---
 drivers/staging/sm750fb/ddk750_dvi.c    | 2 +-
 drivers/staging/sm750fb/ddk750_sii164.c | 4 ++--
 drivers/staging/sm750fb/ddk750_sii164.h | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/sm750fb/ddk750_dvi.c b/drivers/staging/sm750fb/ddk750_dvi.c
index 8b81e8642f9e..cc8ff3978d42 100644
--- a/drivers/staging/sm750fb/ddk750_dvi.c
+++ b/drivers/staging/sm750fb/ddk750_dvi.c
@@ -18,7 +18,7 @@ static struct dvi_ctrl_device dcft_supported_dvi_controller[] = {
 		.get_vendor_id = sii164_get_vendor_id,
 		.get_device_id = sii164GetDeviceID,
 #ifdef SII164_FULL_FUNCTIONS
-		.reset_chip = sii164ResetChip,
+		.reset_chip = sii164_reset_chip,
 		.get_chip_string = sii164GetChipString,
 		.set_power = sii164SetPower,
 		.enable_hot_plug_detection = sii164EnableHotPlugDetection,
diff --git a/drivers/staging/sm750fb/ddk750_sii164.c b/drivers/staging/sm750fb/ddk750_sii164.c
index 2532b60245ac..795f8c86e3c0 100644
--- a/drivers/staging/sm750fb/ddk750_sii164.c
+++ b/drivers/staging/sm750fb/ddk750_sii164.c
@@ -250,10 +250,10 @@ long sii164_init_chip(unsigned char edge_select,
 #ifdef SII164_FULL_FUNCTIONS
 
 /*
- *  sii164ResetChip
+ *  sii164_reset_chip
  *      This function resets the DVI Controller Chip.
  */
-void sii164ResetChip(void)
+void sii164_reset_chip(void)
 {
 	/* Power down */
 	sii164SetPower(0);
diff --git a/drivers/staging/sm750fb/ddk750_sii164.h b/drivers/staging/sm750fb/ddk750_sii164.h
index 71a7c1cb42c4..a9edc9474f87 100644
--- a/drivers/staging/sm750fb/ddk750_sii164.h
+++ b/drivers/staging/sm750fb/ddk750_sii164.h
@@ -31,7 +31,7 @@ unsigned short sii164_get_vendor_id(void);
 unsigned short sii164GetDeviceID(void);
 
 #ifdef SII164_FULL_FUNCTIONS
-void sii164ResetChip(void);
+void sii164_reset_chip(void);
 char *sii164GetChipString(void);
 void sii164SetPower(unsigned char powerUp);
 void sii164EnableHotPlugDetection(unsigned char enableHotPlug);
-- 
2.39.5


^ permalink raw reply related

* [PATCH] staging: sm750fb: fix function name to kernel code style
From: Richard Akintola @ 2025-03-31  4:38 UTC (permalink / raw)
  To: sudip.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
	linux-kernel, outreachy
  Cc: julia.lawall, princerichard17a

Change camelCase function name sii164GetDeviceID to sii164_get_device_id
as reported by checkpatch.pl:

CHECK: Avoid camelCase: <sii164GetDeviceID>

Signed-off-by: Richard Akintola <princerichard17a@gmail.com>
---
 drivers/staging/sm750fb/ddk750_dvi.c    | 2 +-
 drivers/staging/sm750fb/ddk750_sii164.c | 6 +++---
 drivers/staging/sm750fb/ddk750_sii164.h | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/sm750fb/ddk750_dvi.c b/drivers/staging/sm750fb/ddk750_dvi.c
index 8b81e8642f9e..3fb14eff2de1 100644
--- a/drivers/staging/sm750fb/ddk750_dvi.c
+++ b/drivers/staging/sm750fb/ddk750_dvi.c
@@ -16,7 +16,7 @@ static struct dvi_ctrl_device dcft_supported_dvi_controller[] = {
 	{
 		.init = sii164_init_chip,
 		.get_vendor_id = sii164_get_vendor_id,
-		.get_device_id = sii164GetDeviceID,
+		.get_device_id = sii164_get_device_id,
 #ifdef SII164_FULL_FUNCTIONS
 		.reset_chip = sii164ResetChip,
 		.get_chip_string = sii164GetChipString,
diff --git a/drivers/staging/sm750fb/ddk750_sii164.c b/drivers/staging/sm750fb/ddk750_sii164.c
index 2532b60245ac..bdf270f38884 100644
--- a/drivers/staging/sm750fb/ddk750_sii164.c
+++ b/drivers/staging/sm750fb/ddk750_sii164.c
@@ -48,13 +48,13 @@ unsigned short sii164_get_vendor_id(void)
 }
 
 /*
- *  sii164GetDeviceID
+ *  sii164_get_gevice_id
  *      This function gets the device ID of the DVI controller chip.
  *
  *  Output:
  *      Device ID
  */
-unsigned short sii164GetDeviceID(void)
+unsigned short sii164_get_device_id(void)
 {
 	unsigned short deviceID;
 
@@ -141,7 +141,7 @@ long sii164_init_chip(unsigned char edge_select,
 
 	/* Check if SII164 Chip exists */
 	if ((sii164_get_vendor_id() == SII164_VENDOR_ID) &&
-	    (sii164GetDeviceID() == SII164_DEVICE_ID)) {
+	    (sii164_get_device_id() == SII164_DEVICE_ID)) {
 		/*
 		 *  Initialize SII164 controller chip.
 		 */
diff --git a/drivers/staging/sm750fb/ddk750_sii164.h b/drivers/staging/sm750fb/ddk750_sii164.h
index 71a7c1cb42c4..a76091f6622b 100644
--- a/drivers/staging/sm750fb/ddk750_sii164.h
+++ b/drivers/staging/sm750fb/ddk750_sii164.h
@@ -28,7 +28,7 @@ long sii164_init_chip(unsigned char edgeSelect,
 		      unsigned char pllFilterValue);
 
 unsigned short sii164_get_vendor_id(void);
-unsigned short sii164GetDeviceID(void);
+unsigned short sii164_get_device_id(void);
 
 #ifdef SII164_FULL_FUNCTIONS
 void sii164ResetChip(void);
-- 
2.39.5


^ permalink raw reply related

* Re: [GIT PULL] fbdev updates for v6.15-rc1
From: pr-tracker-bot @ 2025-03-29  1:01 UTC (permalink / raw)
  To: Helge Deller; +Cc: Linus Torvalds, linux-kernel, linux-fbdev, dri-devel
In-Reply-To: <Z-WS-lDPPmxnbG3W@carbonx1>

The pull request you sent on Thu, 27 Mar 2025 19:03:38 +0100:

> http://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git tags/fbdev-for-6.15-rc1

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/51aad189f8e0f926c0977d180cae6a78df445f27

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

^ permalink raw reply

* Re: [PATCH v4 08/11] backlight: lcd: Replace fb events with a dedicated function call
From: Thomas Zimmermann @ 2025-03-28 13:18 UTC (permalink / raw)
  To: Lee Jones
  Cc: Daniel Thompson, pavel, jingoohan1, deller, simona, linux-leds,
	dri-devel, linux-fbdev, Simona Vetter
In-Reply-To: <20250328084240.GD585744@google.com>

Hi

Am 28.03.25 um 09:42 schrieb Lee Jones:
> On Mon, 24 Mar 2025, Thomas Zimmermann wrote:
>
>> Hi
>>
>> Am 21.03.25 um 12:27 schrieb Daniel Thompson:
>>> On Fri, Mar 21, 2025 at 10:54:01AM +0100, Thomas Zimmermann wrote:
>>>> Remove support for fb events from the lcd subsystem. Provide the
>>>> helper lcd_notify_blank_all() instead. In fbdev, call
>>>> lcd_notify_blank_all() to inform the lcd subsystem of changes
>>>> to a display's blank state.
>>>>
>>>> Fbdev maintains a list of all installed notifiers. Instead of fbdev
>>>> notifiers, maintain an internal list of lcd devices.
>>>>
>>>> v3:
>>>> - export lcd_notify_mode_change_all() (kernel test robot)
>>>> v2:
>>>> - maintain global list of lcd devices
>>>> - avoid IS_REACHABLE() in source file
>>>> - use lock guards
>>>> - initialize lcd list and list mutex
>>>>
>>>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>>>> Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
>>> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
>> Thanks for reviewing.  There are reviews of all patches. If nothing else
>> comes in, feel free to merge it via the backlight tree.  I can also take the
>> series into dri-devel.
> I plan to take this in via the Backlight tree.  Once applied, I'll send
> out a pull-request for other maintainers to pull from.
>
> For the record, just so we're clear, this will not make v6.15.

Makes sense. Thanks a lot.

Best regards
Thomas

>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)


^ permalink raw reply

* Re: [PATCH v4 08/11] backlight: lcd: Replace fb events with a dedicated function call
From: Lee Jones @ 2025-03-28  8:42 UTC (permalink / raw)
  To: Thomas Zimmermann
  Cc: Daniel Thompson, pavel, jingoohan1, deller, simona, linux-leds,
	dri-devel, linux-fbdev, Simona Vetter
In-Reply-To: <fd216fbf-ff4b-4d33-a8be-b1b7fe525a35@suse.de>

On Mon, 24 Mar 2025, Thomas Zimmermann wrote:

> Hi
> 
> Am 21.03.25 um 12:27 schrieb Daniel Thompson:
> > On Fri, Mar 21, 2025 at 10:54:01AM +0100, Thomas Zimmermann wrote:
> > > Remove support for fb events from the lcd subsystem. Provide the
> > > helper lcd_notify_blank_all() instead. In fbdev, call
> > > lcd_notify_blank_all() to inform the lcd subsystem of changes
> > > to a display's blank state.
> > > 
> > > Fbdev maintains a list of all installed notifiers. Instead of fbdev
> > > notifiers, maintain an internal list of lcd devices.
> > > 
> > > v3:
> > > - export lcd_notify_mode_change_all() (kernel test robot)
> > > v2:
> > > - maintain global list of lcd devices
> > > - avoid IS_REACHABLE() in source file
> > > - use lock guards
> > > - initialize lcd list and list mutex
> > > 
> > > Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> > > Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
> > Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>
> 
> Thanks for reviewing.  There are reviews of all patches. If nothing else
> comes in, feel free to merge it via the backlight tree.  I can also take the
> series into dri-devel.

I plan to take this in via the Backlight tree.  Once applied, I'll send
out a pull-request for other maintainers to pull from.

For the record, just so we're clear, this will not make v6.15.

-- 
Lee Jones [李琼斯]

^ permalink raw reply

* [GIT PULL] fbdev updates for v6.15-rc1
From: Helge Deller @ 2025-03-27 18:03 UTC (permalink / raw)
  To: Linus Torvalds, linux-kernel, linux-fbdev, dri-devel

Hi Linus,

please pull some updates regarding fbdev for 6.15-rc1:

The fbcon packed pixel drawing routines have been refactored to bring the
implementations for system and I/O memory in sync.  The other patches add some
parameter checks, static attribute groups for sysfs entries and console fixes.

Thanks,
Helge

----------------------------------------------------------------
The following changes since commit f6e0150b2003fb2b9265028a618aa1732b3edc8f:

  Merge tag 'mtd/for-6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux (2025-03-26 10:28:36 -0700)

are available in the Git repository at:

  http://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git tags/fbdev-for-6.15-rc1

for you to fetch changes up to 86d16cd12efa547ed43d16ba7a782c1251c80ea8:

  fbdev: fsl-diu-fb: add missing device_remove_file() (2025-03-26 22:39:21 +0100)

----------------------------------------------------------------
fbdev fixes and updates for 6.15-rc1:

This includes a major refactoring of the fbcon packed pixel drawing routines,
contributed by Zsolt Kajtar.  The original version duplicated more or less the
same algorithms for both system and i/o memory.  The new implementation is more
robust, both implementations are now feature complete (e.g. pixel order
reversing now supported by both), behaves the same way as it uses the identical
code for both variants and adds support for foreign endian framebuffers.

The other fixes and cleanups are:
- dummycon: only build module if there are users and fix rows/cols (Arnd Bergmann)
- mdacon: rework dependency list (Arnd Bergmann)
- lcdcfb, fsl-diu-fb, fbcon: Fix registering and removing of sysfs (Shixiong Ou)
- sm501fb: Add some geometry checks (Danila Chernetsov)
- omapfb: Remove unused code, add value checks (Leonid Arapov)
- au1100fb: Clean up variable assignment (Markus Elfring)
- pxafb: use devm_kmemdup*()  (Raag Jadav)

----------------------------------------------------------------
Arnd Bergmann (3):
      dummycon: only build module if there are users
      dummycon: fix default rows/cols
      mdacon: rework dependency list

Danila Chernetsov (1):
      fbdev: sm501fb: Add some geometry checks.

Leonid Arapov (2):
      fbdev: omapfb: Remove writeback deadcode
      fbdev: omapfb: Add 'plane' value check

Markus Elfring (1):
      fbdev: au1100fb: Move a variable assignment behind a null pointer check

Raag Jadav (1):
      fbdev: pxafb: use devm_kmemdup*()

Shixiong Ou (4):
      fbdev: lcdcfb: Register sysfs groups through driver core
      fbdev: Register sysfs groups through device_add_group
      fbcon: Use static attribute groups for sysfs entries
      fbdev: fsl-diu-fb: add missing device_remove_file()

Zsolt Kajtar (6):
      fbdev: core: tileblit: Implement missing margin clearing for tileblit
      fbcon: Use correct erase colour for clearing in fbcon
      fbdev: mach64_cursor: Remove fb_draw.h includes
      fbdev: wmt_ge_rops: Remove fb_draw.h includes
      fbdev: Refactoring the fbcon packed pixel drawing routines
      MAINTAINERS: Add contact info for fbdev packed pixel drawing

 MAINTAINERS                                  |  16 +
 drivers/video/console/Kconfig                |   9 +-
 drivers/video/fbdev/aty/mach64_cursor.c      |   7 +-
 drivers/video/fbdev/au1100fb.c               |   4 +-
 drivers/video/fbdev/core/Kconfig             |  10 +-
 drivers/video/fbdev/core/bitblit.c           |   5 +-
 drivers/video/fbdev/core/cfbcopyarea.c       | 428 +----------------------
 drivers/video/fbdev/core/cfbfillrect.c       | 362 +-------------------
 drivers/video/fbdev/core/cfbimgblt.c         | 357 +------------------
 drivers/video/fbdev/core/cfbmem.h            |  43 +++
 drivers/video/fbdev/core/fb_copyarea.h       | 405 ++++++++++++++++++++++
 drivers/video/fbdev/core/fb_draw.h           | 274 +++++++--------
 drivers/video/fbdev/core/fb_fillrect.h       | 280 +++++++++++++++
 drivers/video/fbdev/core/fb_imageblit.h      | 495 +++++++++++++++++++++++++++
 drivers/video/fbdev/core/fbcon.c             |  79 ++---
 drivers/video/fbdev/core/fbcon.h             |  38 +-
 drivers/video/fbdev/core/fbcon_ccw.c         |   5 +-
 drivers/video/fbdev/core/fbcon_cw.c          |   5 +-
 drivers/video/fbdev/core/fbcon_ud.c          |   5 +-
 drivers/video/fbdev/core/fbsysfs.c           |  69 ++--
 drivers/video/fbdev/core/syscopyarea.c       | 369 +-------------------
 drivers/video/fbdev/core/sysfillrect.c       | 324 +-----------------
 drivers/video/fbdev/core/sysimgblt.c         | 333 +-----------------
 drivers/video/fbdev/core/sysmem.h            |  39 +++
 drivers/video/fbdev/core/tileblit.c          |  45 ++-
 drivers/video/fbdev/fsl-diu-fb.c             |   1 +
 drivers/video/fbdev/omap2/omapfb/dss/dispc.c |  15 +-
 drivers/video/fbdev/pxafb.c                  |  23 +-
 drivers/video/fbdev/sh_mobile_lcdcfb.c       |  29 +-
 drivers/video/fbdev/sm501fb.c                |   7 +
 drivers/video/fbdev/wmt_ge_rops.c            |  30 +-
 31 files changed, 1670 insertions(+), 2441 deletions(-)
 create mode 100644 drivers/video/fbdev/core/cfbmem.h
 create mode 100644 drivers/video/fbdev/core/fb_copyarea.h
 create mode 100644 drivers/video/fbdev/core/fb_fillrect.h
 create mode 100644 drivers/video/fbdev/core/fb_imageblit.h
 create mode 100644 drivers/video/fbdev/core/sysmem.h

^ permalink raw reply

* Re: [PATCH 1/1] fbdev: atyfb: Fix buffer overflow
From: Jani Nikula @ 2025-03-27 10:14 UTC (permalink / raw)
  To: Denis Arefev, Helge Deller
  Cc: Thomas Zimmermann, linux-fbdev, dri-devel, linux-kernel,
	lvc-project
In-Reply-To: <20250327100126.12585-2-arefev@swemel.ru>

On Thu, 27 Mar 2025, Denis Arefev <arefev@swemel.ru> wrote:
> The value LCD_MISC_CNTL is used in the 'aty_st_lcd()' function to
> calculate an index for accessing an array element of size 9.
> This may cause a buffer overflow.

The fix is to fix it, not silently brush it under the carpet.

BR,
Jani.

>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Denis Arefev <arefev@swemel.ru>
> ---
>  drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
> index 210fd3ac18a4..93eb5eb6042b 100644
> --- a/drivers/video/fbdev/aty/atyfb_base.c
> +++ b/drivers/video/fbdev/aty/atyfb_base.c
> @@ -149,6 +149,8 @@ static const u32 lt_lcd_regs[] = {
>  void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
>  {
>  	if (M64_HAS(LT_LCD_REGS)) {
> +		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
> +			return;
>  		aty_st_le32(lt_lcd_regs[index], val, par);
>  	} else {
>  		unsigned long temp;
> @@ -164,6 +166,8 @@ void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
>  u32 aty_ld_lcd(int index, const struct atyfb_par *par)
>  {
>  	if (M64_HAS(LT_LCD_REGS)) {
> +		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
> +			return 0;
>  		return aty_ld_le32(lt_lcd_regs[index], par);
>  	} else {
>  		unsigned long temp;

-- 
Jani Nikula, Intel

^ permalink raw reply

* [PATCH 0/1] fbdev: atyfb: Fix buffer overflow
From: Denis Arefev @ 2025-03-27 10:01 UTC (permalink / raw)
  To: Helge Deller
  Cc: Thomas Zimmermann, Jani Nikula, linux-fbdev, dri-devel,
	linux-kernel, lvc-project

The fixes I suggested are not the only ones.
There are more options for solving this problem.

1.Find datasheet for the chip, find out the register offset, calculate
   the address using the formula (4*Dword offset), add this value to
   the array lt_lcd_regs[] at index LCD_MISC_CNTL.

2. Delete this code completely, as the chip is very obsolete and 
   not applicable.

Found by Linux Verification Center (linuxtesting.org) with SVACE.  

Denis Arefev (1):
  fbdev: atyfb: Fix buffer overflow

 drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
 1 file changed, 4 insertions(+)

base-commit: 1a9239bb4253f9076b5b4b2a1a4e8d7defd77a95
-- 
2.43.0


^ permalink raw reply

* [PATCH 1/1] fbdev: atyfb: Fix buffer overflow
From: Denis Arefev @ 2025-03-27 10:01 UTC (permalink / raw)
  To: Helge Deller
  Cc: Thomas Zimmermann, Jani Nikula, linux-fbdev, dri-devel,
	linux-kernel, lvc-project
In-Reply-To: <20250327100126.12585-1-arefev@swemel.ru>

The value LCD_MISC_CNTL is used in the 'aty_st_lcd()' function to
calculate an index for accessing an array element of size 9.
This may cause a buffer overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
 drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
index 210fd3ac18a4..93eb5eb6042b 100644
--- a/drivers/video/fbdev/aty/atyfb_base.c
+++ b/drivers/video/fbdev/aty/atyfb_base.c
@@ -149,6 +149,8 @@ static const u32 lt_lcd_regs[] = {
 void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
 {
 	if (M64_HAS(LT_LCD_REGS)) {
+		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
+			return;
 		aty_st_le32(lt_lcd_regs[index], val, par);
 	} else {
 		unsigned long temp;
@@ -164,6 +166,8 @@ void aty_st_lcd(int index, u32 val, const struct atyfb_par *par)
 u32 aty_ld_lcd(int index, const struct atyfb_par *par)
 {
 	if (M64_HAS(LT_LCD_REGS)) {
+		if ((u32)index >= ARRAY_SIZE(lt_lcd_regs))
+			return 0;
 		return aty_ld_le32(lt_lcd_regs[index], par);
 	} else {
 		unsigned long temp;
-- 
2.43.0


^ permalink raw reply related

* Re: fbdev deferred I/O broken in some scenarios
From: Geert Uytterhoeven @ 2025-03-24 13:59 UTC (permalink / raw)
  To: Michael Kelley
  Cc: Helge Deller, linux-fbdev@vger.kernel.org,
	linux-kernel@vger.kernel.org, linux-hyperv@vger.kernel.org
In-Reply-To: <SN6PR02MB415740F004283A40C3C41490D4D82@SN6PR02MB4157.namprd02.prod.outlook.com>

Hi Michael,

On Thu, 20 Mar 2025 at 21:15, Michael Kelley <mhklinux@outlook.com> wrote:
> From: Geert Uytterhoeven <geert@linux-m68k.org> Sent: Thursday, March 20, 2025 3:46 AM
> > On Wed, 19 Mar 2025 at 21:29, Michael Kelley <mhklinux@outlook.com> wrote:
> > > From: Helge Deller <deller@gmx.de> Sent: Tuesday, March 18, 2025 1:16 AM
> > > > On 3/18/25 03:05, Michael Kelley wrote:
> > > > > The fbdev deferred I/O support was originally added to the hyperv_fb driver in the
> > > > > 5.6 kernel, and based on my recent experiments, it has never worked correctly when
> > > > > the framebuffer is allocated from kernel memory. fbdev deferred I/O support for using
> > > > > kernel memory as the framebuffer was originally added in commit 37b4837959cb9
> > > > > back in 2008 in Linux 2.6.29. But I don't see how it ever worked properly, unless
> > > > > changes in generic memory management somehow broke it in the intervening years.
> > > > >
> > > > > I think I know how to fix all this. But before working on a patch, I wanted to check
> > > > > with the fbdev community to see if this might be a known issue and whether there
> > > > > is any additional insight someone might offer. Thanks for any comments or help.
> > > >
> > > > I haven't heard of any major deferred-i/o issues since I've jumped into fbdev
> > > > maintenance. But you might be right, as I haven't looked much into it yet and
> > > > there are just a few drivers using it.
> > >
> > > Thanks for the input. In the fbdev directory, there are 9 drivers using deferred I/O.
> > > Of those, 6 use vmalloc() to allocate the framebuffer, and that path works just fine.
> > > The other 3 use alloc_pages(), dma_alloc_coherent(), or __get_free_pages(), all of
> > > which manifest the underlying problem when munmap()'ed.  Those 3 drivers are:
> > >
> > > * hyperv_fb.c, which I'm working with
> > > * sh_mobile_lcdcfb.c
> > > * ssd1307fb.c
> >
> > Nowadays sh_mobile_lcdcfb is used only on various SuperH boards
> > (I have no hardware to test).
> >
> > sh_mobile_lcdcfb was used on ARM-based SH/R-Mobile SoCs until DT
> > support was added to the DRM driver for the corresponding hardware.
> > The platform using it was migrated to DRM in commit 138588e9fa237f97
> > ("ARM: dts: renesas: r8a7740: Add LCDC nodes") in v6.8). At the time
> > of the conversion, fbtest worked fine with sh_mobile_lcdcfb.
>
> OK, good to know. sh_mobile_lcdcfb gets its framebuffer using
> dma_alloc_coherent(). Do you recall how big the framebuffer was?
> If over 4 MiB, dma_alloc_coherent() would have allocated from CMA,
> and that works OK.

1536000 bytes (800x480 (960 virtual), 16bpp), i.e. less than 4 MiB.

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

^ permalink raw reply

* Re: [PATCH v4 08/11] backlight: lcd: Replace fb events with a dedicated function call
From: Thomas Zimmermann @ 2025-03-24  7:43 UTC (permalink / raw)
  To: Daniel Thompson
  Cc: lee, pavel, jingoohan1, deller, simona, linux-leds, dri-devel,
	linux-fbdev, Simona Vetter
In-Reply-To: <Z91NHP65X9GFIYOe@aspen.lan>

Hi

Am 21.03.25 um 12:27 schrieb Daniel Thompson:
> On Fri, Mar 21, 2025 at 10:54:01AM +0100, Thomas Zimmermann wrote:
>> Remove support for fb events from the lcd subsystem. Provide the
>> helper lcd_notify_blank_all() instead. In fbdev, call
>> lcd_notify_blank_all() to inform the lcd subsystem of changes
>> to a display's blank state.
>>
>> Fbdev maintains a list of all installed notifiers. Instead of fbdev
>> notifiers, maintain an internal list of lcd devices.
>>
>> v3:
>> - export lcd_notify_mode_change_all() (kernel test robot)
>> v2:
>> - maintain global list of lcd devices
>> - avoid IS_REACHABLE() in source file
>> - use lock guards
>> - initialize lcd list and list mutex
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>

Thanks for reviewing.  There are reviews of all patches. If nothing else 
comes in, feel free to merge it via the backlight tree.  I can also take 
the series into dri-devel.

Best regards
Thomas

>
>
> Daniel.
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)


^ permalink raw reply

* [PATCH] staging: sm750fb: fix casing style on getDeviceID
From: Justin Cromer @ 2025-03-23 22:46 UTC (permalink / raw)
  To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman, linux-fbdev,
	linux-staging, linux-kernel

Fixes camel casing for getDeviceID function. This includes an update to
the internal function variable 'deviceID' as it's relevant, needs updating,
and is clearly scoped to the small function.

Signed-off-by: Justin Cromer <justincromer@gmail.com>
---

First patch for me, so I chose a checkpatch.pl issue to get comfortable
with the workflow. Any and all nits welcome. 

Verified my change by recompiling and loading the module in question.
Additionaly, checkpatch.pl reports two fewer errors.

 drivers/staging/sm750fb/ddk750_dvi.c    |  2 +-
 drivers/staging/sm750fb/ddk750_sii164.c | 12 ++++++------
 drivers/staging/sm750fb/ddk750_sii164.h |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/sm750fb/ddk750_dvi.c b/drivers/staging/sm750fb/ddk750_dvi.c
index 8b81e8642f9e..3fb14eff2de1 100644
--- a/drivers/staging/sm750fb/ddk750_dvi.c
+++ b/drivers/staging/sm750fb/ddk750_dvi.c
@@ -16,7 +16,7 @@ static struct dvi_ctrl_device dcft_supported_dvi_controller[] = {
 	{
 		.init = sii164_init_chip,
 		.get_vendor_id = sii164_get_vendor_id,
-		.get_device_id = sii164GetDeviceID,
+		.get_device_id = sii164_get_device_id,
 #ifdef SII164_FULL_FUNCTIONS
 		.reset_chip = sii164ResetChip,
 		.get_chip_string = sii164GetChipString,
diff --git a/drivers/staging/sm750fb/ddk750_sii164.c b/drivers/staging/sm750fb/ddk750_sii164.c
index 2532b60245ac..d50c71824321 100644
--- a/drivers/staging/sm750fb/ddk750_sii164.c
+++ b/drivers/staging/sm750fb/ddk750_sii164.c
@@ -48,22 +48,22 @@ unsigned short sii164_get_vendor_id(void)
 }
 
 /*
- *  sii164GetDeviceID
+ *  sii164_get_device_id
  *      This function gets the device ID of the DVI controller chip.
  *
  *  Output:
  *      Device ID
  */
-unsigned short sii164GetDeviceID(void)
+unsigned short sii164_get_device_id(void)
 {
-	unsigned short deviceID;
+	unsigned short device_id;
 
-	deviceID = ((unsigned short)i2cReadReg(SII164_I2C_ADDRESS,
+	device_id = ((unsigned short)i2cReadReg(SII164_I2C_ADDRESS,
 					       SII164_DEVICE_ID_HIGH) << 8) |
 		   (unsigned short)i2cReadReg(SII164_I2C_ADDRESS,
 					      SII164_DEVICE_ID_LOW);
 
-	return deviceID;
+	return device_id;
 }
 
 /*
@@ -141,7 +141,7 @@ long sii164_init_chip(unsigned char edge_select,
 
 	/* Check if SII164 Chip exists */
 	if ((sii164_get_vendor_id() == SII164_VENDOR_ID) &&
-	    (sii164GetDeviceID() == SII164_DEVICE_ID)) {
+	    (sii164_get_device_id() == SII164_DEVICE_ID)) {
 		/*
 		 *  Initialize SII164 controller chip.
 		 */
diff --git a/drivers/staging/sm750fb/ddk750_sii164.h b/drivers/staging/sm750fb/ddk750_sii164.h
index 71a7c1cb42c4..a76091f6622b 100644
--- a/drivers/staging/sm750fb/ddk750_sii164.h
+++ b/drivers/staging/sm750fb/ddk750_sii164.h
@@ -28,7 +28,7 @@ long sii164_init_chip(unsigned char edgeSelect,
 		      unsigned char pllFilterValue);
 
 unsigned short sii164_get_vendor_id(void);
-unsigned short sii164GetDeviceID(void);
+unsigned short sii164_get_device_id(void);
 
 #ifdef SII164_FULL_FUNCTIONS
 void sii164ResetChip(void);
-- 
2.49.0


^ permalink raw reply related

* [PATCH] video: fbdev: kyro: Add some geometry checks.
From: Danila Chernetsov @ 2025-03-23 18:57 UTC (permalink / raw)
  To: Helge Deller
  Cc: Danila Chernetsov, linux-fbdev, dri-devel, linux-kernel,
	lvc-project

The check protects against division by 0, integer wraparound,
and overflow Start/End window settings.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
---
 drivers/video/fbdev/kyro/fbdev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 08ee8baa79f8..1d5246313d9a 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -378,6 +378,13 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight
 	    (x < 2 && ulWidth + 2 == 0))
 		return -EINVAL;
 
+	/* The check protects against division by 0, integer wraparound,
+	 * and overflow Start/End window settings.
+	 */
+	if (x + ulWidth - 1 <= x || y + ulHeight - 1 <= y ||
+	    x + ulWidth - 1 > 65535 || y + ulHeight - 1 > 65535)
+		return -EINVAL;
+
 	/* Stop Ramdac Output */
 	DisableRamdacOutput(deviceInfo.pSTGReg);
 
-- 
2.25.1


^ permalink raw reply related

* Re: [PATCH v4 08/11] backlight: lcd: Replace fb events with a dedicated function call
From: Daniel Thompson @ 2025-03-21 11:27 UTC (permalink / raw)
  To: Thomas Zimmermann
  Cc: lee, pavel, jingoohan1, deller, simona, linux-leds, dri-devel,
	linux-fbdev, Simona Vetter
In-Reply-To: <20250321095517.313713-9-tzimmermann@suse.de>

On Fri, Mar 21, 2025 at 10:54:01AM +0100, Thomas Zimmermann wrote:
> Remove support for fb events from the lcd subsystem. Provide the
> helper lcd_notify_blank_all() instead. In fbdev, call
> lcd_notify_blank_all() to inform the lcd subsystem of changes
> to a display's blank state.
>
> Fbdev maintains a list of all installed notifiers. Instead of fbdev
> notifiers, maintain an internal list of lcd devices.
>
> v3:
> - export lcd_notify_mode_change_all() (kernel test robot)
> v2:
> - maintain global list of lcd devices
> - avoid IS_REACHABLE() in source file
> - use lock guards
> - initialize lcd list and list mutex
>
> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> Acked-by: Simona Vetter <simona.vetter@ffwll.ch>

Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>


Daniel.

^ permalink raw reply

* Re: [PATCH v4 06/11] backlight: Replace fb events with a dedicated function call
From: Daniel Thompson @ 2025-03-21 11:26 UTC (permalink / raw)
  To: Thomas Zimmermann
  Cc: lee, pavel, jingoohan1, deller, simona, linux-leds, dri-devel,
	linux-fbdev, Simona Vetter
In-Reply-To: <20250321095517.313713-7-tzimmermann@suse.de>

On Fri, Mar 21, 2025 at 10:53:59AM +0100, Thomas Zimmermann wrote:
> Remove support for fb events from backlight subsystem. Provide the
> helper backlight_notify_blank_all() instead. Also export the existing
> helper backlight_notify_blank() to update a single backlight device.
>
> In fbdev, call either helper to inform the backlight subsystem of
> changes to a display's blank state. If the framebuffer device has a
> specific backlight, only update this one; otherwise update all.
>
> v4:
> - protect blacklight declarations with IS_REACHABLE() (kernel test robot)

I was convinced by the replies to other things in v4. Thanks!

> v3:
> - declare empty fb_bl_notify_blank() as static inline (kernel test robot)
>
> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> Acked-by: Simona Vetter <simona.vetter@ffwll.ch>


Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>


Daniel.

^ permalink raw reply

* [PATCH v4 10/11] leds: backlight trigger: Replace fb events with a dedicated function call
From: Thomas Zimmermann @ 2025-03-21  9:54 UTC (permalink / raw)
  To: lee, pavel, danielt, jingoohan1, deller, simona
  Cc: linux-leds, dri-devel, linux-fbdev, Thomas Zimmermann,
	Simona Vetter
In-Reply-To: <20250321095517.313713-1-tzimmermann@suse.de>

Remove support for fb events from the led backlight trigger. Provide
the helper ledtrig_backlight_blank() instead. Call it from fbdev to
inform the trigger of changes to a display's blank state.

Fbdev maintains a list of all installed notifiers. Instead of the fbdev
notifiers, maintain an internal list of led backlight triggers.

v3:
- export ledtrig_backlight_blank()
v2:
- maintain global list of led backlight triggers (Lee)
- avoid IS_REACHABLE() in source file (Lee)
- notify on changes to blank state instead of display state
- use lock guards
- initialize led list and list mutex

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Acked-by: Simona Vetter <simona.vetter@ffwll.ch>
---
 drivers/leds/trigger/ledtrig-backlight.c | 42 ++++++++++--------------
 drivers/video/fbdev/core/fbmem.c         | 19 ++++++-----
 include/linux/leds.h                     |  6 ++++
 3 files changed, 33 insertions(+), 34 deletions(-)

diff --git a/drivers/leds/trigger/ledtrig-backlight.c b/drivers/leds/trigger/ledtrig-backlight.c
index 8e66d55a6c82..c1f0f5becaee 100644
--- a/drivers/leds/trigger/ledtrig-backlight.c
+++ b/drivers/leds/trigger/ledtrig-backlight.c
@@ -10,7 +10,6 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/init.h>
-#include <linux/fb.h>
 #include <linux/leds.h>
 #include "../leds.h"
 
@@ -21,10 +20,14 @@ struct bl_trig_notifier {
 	struct led_classdev *led;
 	int brightness;
 	int old_status;
-	struct notifier_block notifier;
 	unsigned invert;
+
+	struct list_head entry;
 };
 
+static DEFINE_MUTEX(ledtrig_backlight_list_mutex);
+static LIST_HEAD(ledtrig_backlight_list);
+
 static void ledtrig_backlight_notify_blank(struct bl_trig_notifier *n, int new_status)
 {
 	struct led_classdev *led = n->led;
@@ -42,26 +45,17 @@ static void ledtrig_backlight_notify_blank(struct bl_trig_notifier *n, int new_s
 	n->old_status = new_status;
 }
 
-static int fb_notifier_callback(struct notifier_block *p,
-				unsigned long event, void *data)
+void ledtrig_backlight_blank(bool blank)
 {
-	struct bl_trig_notifier *n = container_of(p,
-					struct bl_trig_notifier, notifier);
-	struct fb_event *fb_event = data;
-	int *blank;
-	int new_status;
-
-	/* If we aren't interested in this event, skip it immediately ... */
-	if (event != FB_EVENT_BLANK)
-		return 0;
-
-	blank = fb_event->data;
-	new_status = *blank ? BLANK : UNBLANK;
+	struct bl_trig_notifier *n;
+	int new_status = blank ? BLANK : UNBLANK;
 
-	ledtrig_backlight_notify_blank(n, new_status);
+	guard(mutex)(&ledtrig_backlight_list_mutex);
 
-	return 0;
+	list_for_each_entry(n, &ledtrig_backlight_list, entry)
+		ledtrig_backlight_notify_blank(n, new_status);
 }
+EXPORT_SYMBOL(ledtrig_backlight_blank);
 
 static ssize_t bl_trig_invert_show(struct device *dev,
 		struct device_attribute *attr, char *buf)
@@ -106,8 +100,6 @@ ATTRIBUTE_GROUPS(bl_trig);
 
 static int bl_trig_activate(struct led_classdev *led)
 {
-	int ret;
-
 	struct bl_trig_notifier *n;
 
 	n = kzalloc(sizeof(struct bl_trig_notifier), GFP_KERNEL);
@@ -118,11 +110,9 @@ static int bl_trig_activate(struct led_classdev *led)
 	n->led = led;
 	n->brightness = led->brightness;
 	n->old_status = UNBLANK;
-	n->notifier.notifier_call = fb_notifier_callback;
 
-	ret = fb_register_client(&n->notifier);
-	if (ret)
-		dev_err(led->dev, "unable to register backlight trigger\n");
+	guard(mutex)(&ledtrig_backlight_list_mutex);
+	list_add(&n->entry, &ledtrig_backlight_list);
 
 	return 0;
 }
@@ -131,7 +121,9 @@ static void bl_trig_deactivate(struct led_classdev *led)
 {
 	struct bl_trig_notifier *n = led_get_trigger_data(led);
 
-	fb_unregister_client(&n->notifier);
+	guard(mutex)(&ledtrig_backlight_list_mutex);
+	list_del(&n->entry);
+
 	kfree(n);
 }
 
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 001662c606d7..f089f72ec75a 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -16,6 +16,7 @@
 #include <linux/fb.h>
 #include <linux/fbcon.h>
 #include <linux/lcd.h>
+#include <linux/leds.h>
 
 #include <video/nomodeset.h>
 
@@ -369,11 +370,17 @@ static void fb_lcd_notify_blank(struct fb_info *info)
 	lcd_notify_blank_all(info->device, power);
 }
 
+static void fb_ledtrig_backlight_notify_blank(struct fb_info *info)
+{
+	if (info->blank == FB_BLANK_UNBLANK)
+		ledtrig_backlight_blank(false);
+	else
+		ledtrig_backlight_blank(true);
+}
+
 int fb_blank(struct fb_info *info, int blank)
 {
 	int old_blank = info->blank;
-	struct fb_event event;
-	int data[2];
 	int ret;
 
 	if (!info->fbops->fb_blank)
@@ -382,11 +389,6 @@ int fb_blank(struct fb_info *info, int blank)
 	if (blank > FB_BLANK_POWERDOWN)
 		blank = FB_BLANK_POWERDOWN;
 
-	data[0] = blank;
-	data[1] = old_blank;
-	event.info = info;
-	event.data = data;
-
 	info->blank = blank;
 
 	ret = info->fbops->fb_blank(blank, info);
@@ -395,8 +397,7 @@ int fb_blank(struct fb_info *info, int blank)
 
 	fb_bl_notify_blank(info, old_blank);
 	fb_lcd_notify_blank(info);
-
-	fb_notifier_call_chain(FB_EVENT_BLANK, &event);
+	fb_ledtrig_backlight_notify_blank(info);
 
 	return 0;
 
diff --git a/include/linux/leds.h b/include/linux/leds.h
index 98f9719c924c..b3f0aa081064 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -640,6 +640,12 @@ static inline void ledtrig_flash_ctrl(bool on) {}
 static inline void ledtrig_torch_ctrl(bool on) {}
 #endif
 
+#if IS_REACHABLE(CONFIG_LEDS_TRIGGER_BACKLIGHT)
+void ledtrig_backlight_blank(bool blank);
+#else
+static inline void ledtrig_backlight_blank(bool blank) {}
+#endif
+
 /*
  * Generic LED platform data for describing LED names and default triggers.
  */
-- 
2.48.1


^ permalink raw reply related


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox