* Re: [PATCH v2] fbdev/radeon: Remove stale product link in Kconfig/FB_RADEON
From: Helge Deller @ 2025-09-30 19:51 UTC (permalink / raw)
To: Sukrut Heroorkar, open list:FRAMEBUFFER LAYER,
open list:FRAMEBUFFER LAYER
In-Reply-To: <20250923171409.25927-1-hsukrut3@gmail.com>
On 9/23/25 19:14, Sukrut Heroorkar wrote:
> The product page referenced in the FB_RADEON is no longer valid.
> Remove it to avoid pointing to an invalid link.
>
> Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
> ---
> Changes since v1:
> - Dropped the link entirely as suggested
> (See: https://lore.kernel.org/all/CADnq5_NHu5=esJZrgy_S80jF68ZapRRYX4_L70DwDDSN3VXitQ@mail.gmail.com/)
>
> drivers/video/fbdev/Kconfig | 3 ---
> 1 file changed, 3 deletions(-)
applied.
Thanks!
Helge
^ permalink raw reply
* Re: [PATCH 6/6] fbcon: Pass struct fbcon to callbacks in struct fbcon_bitops
From: Helge Deller @ 2025-09-30 19:47 UTC (permalink / raw)
To: Thomas Zimmermann, Sam Ravnborg; +Cc: linux-fbdev, dri-devel
In-Reply-To: <60f8cfc8-ccc0-4a55-bce5-7ab30c3ae1c1@suse.de>
On 9/8/25 15:08, Thomas Zimmermann wrote:
> Am 05.09.25 um 21:00 schrieb Sam Ravnborg:
>> On Mon, Aug 18, 2025 at 12:36:41PM +0200, Thomas Zimmermann wrote:
>>> The callbacks in struct fbcon_bitops are for struct fbcon. Pass an
>>> instance to the callbacks; instead of the respective struct fb_info.
>> This looks looks like a pointless change.
>> All the operations requires fb_info and needs to pcik it anyway.
>
> Yeah, it's in preparation of a later change. As I already had the
> patch ready, i submitted it. I'll drop it now and re-submit when
> it's required.
Let me know if I should add your series to fbdev for-next git tree to get some
testing...
Helge
^ permalink raw reply
* Re: [PATCH v2 1/3] Documentation: fb: ep93xx: Demote section headings
From: Helge Deller @ 2025-09-30 19:37 UTC (permalink / raw)
To: Bagas Sanjaya, Linux Documentation, Linux Framebuffer,
Linux DRI Development, Randy Dunlap
In-Reply-To: <20250922103615.42925-3-bagasdotme@gmail.com>
On 9/22/25 12:36, Bagas Sanjaya wrote:
> Section headings are formatted the same as title heading, thus
> increasing number of entries in framebuffer toctree. Demote them.
>
> Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
> Tested-by: Randy Dunlap <rdunlap@infradead.org>
> Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
> ---
> Documentation/fb/ep93xx-fb.rst | 4 ----
> 1 file changed, 4 deletions(-)
Patch series applied to fbdev git tree.
Thanks a lot!
Helge
^ permalink raw reply
* Re: [PATCH 1/2] fbdev/hyperv_fb: deprecate this in favor of Hyper-V DRM driver
From: Helge Deller @ 2025-09-30 19:26 UTC (permalink / raw)
To: Michael Kelley, Prasanna Kumar T S M,
dri-devel@lists.freedesktop.org, linux-hyperv@vger.kernel.org,
linux-fbdev@vger.kernel.org
In-Reply-To: <SN6PR02MB4157B55FBE271DB1B75F8FBCD416A@SN6PR02MB4157.namprd02.prod.outlook.com>
On 9/18/25 06:01, Michael Kelley wrote:
> From: Prasanna Kumar T S M <ptsm@linux.microsoft.com> Sent: Wednesday, September 17, 2025 7:03 AM
>>
>> The Hyper-V DRM driver is available since kernel version 5.14 and it
>> provides full KMS support and fbdev emulation via the DRM fbdev helpers.
>> Deprecate this driver in favor of Hyper-V DRM driver.
>>
>> Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
>> ---
>> drivers/video/fbdev/Kconfig | 5 ++++-
>> drivers/video/fbdev/hyperv_fb.c | 2 ++
>> 2 files changed, 6 insertions(+), 1 deletion(-)
Series applied to fbdev git tree.
Thanks!
Helge
^ permalink raw reply
* Re: [PATCH v3] fbdev/simplefb: Fix use after free in simplefb_detach_genpds()
From: Helge Deller @ 2025-09-30 19:12 UTC (permalink / raw)
To: Janne Grunau, Hans de Goede, Thierry Reding
Cc: linux-fbdev, dri-devel, linux-kernel, Daniel Huhardeaux, stable
In-Reply-To: <20250915-simplefb-genpd-uaf-v3-1-5bb51506a5b9@jannau.net>
On 9/15/25 08:36, Janne Grunau wrote:
> The pm_domain cleanup can not be devres managed as it uses struct
> simplefb_par which is allocated within struct fb_info by
> framebuffer_alloc(). This allocation is explicitly freed by
> unregister_framebuffer() in simplefb_remove().
> Devres managed cleanup runs after the device remove call and thus can no
> longer access struct simplefb_par.
> Call simplefb_detach_genpds() explicitly from simplefb_destroy() like
> the cleanup functions for clocks and regulators.
>
> Fixes an use after free on M2 Mac mini during
> aperture_remove_conflicting_devices() using the downstream asahi kernel
> with Debian's kernel config. For unknown reasons this started to
> consistently dereference an invalid pointer in v6.16.3 based kernels.
>
> [ 6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220
> [ 6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev-worker)/227
> [ 6.750697]
> [ 6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S 6.16.3-asahi+ #16 PREEMPTLAZY
> [ 6.752186] Tainted: [S]=CPU_OUT_OF_SPEC
> [ 6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT)
> [ 6.752189] Call trace:
> [ 6.752190] show_stack+0x34/0x98 (C)
> [ 6.752194] dump_stack_lvl+0x60/0x80
> [ 6.752197] print_report+0x17c/0x4d8
> [ 6.752201] kasan_report+0xb4/0x100
> [ 6.752206] __asan_report_load4_noabort+0x20/0x30
> [ 6.752209] simplefb_detach_genpds+0x58/0x220
> [ 6.752213] devm_action_release+0x50/0x98
> [ 6.752216] release_nodes+0xd0/0x2c8
> [ 6.752219] devres_release_all+0xfc/0x178
> [ 6.752221] device_unbind_cleanup+0x28/0x168
> [ 6.752224] device_release_driver_internal+0x34c/0x470
> [ 6.752228] device_release_driver+0x20/0x38
> [ 6.752231] bus_remove_device+0x1b0/0x380
> [ 6.752234] device_del+0x314/0x820
> [ 6.752238] platform_device_del+0x3c/0x1e8
> [ 6.752242] platform_device_unregister+0x20/0x50
> [ 6.752246] aperture_detach_platform_device+0x1c/0x30
> [ 6.752250] aperture_detach_devices+0x16c/0x290
> [ 6.752253] aperture_remove_conflicting_devices+0x34/0x50
> ...
> [ 6.752343]
> [ 6.967409] Allocated by task 62:
> [ 6.970724] kasan_save_stack+0x3c/0x70
> [ 6.974560] kasan_save_track+0x20/0x40
> [ 6.978397] kasan_save_alloc_info+0x40/0x58
> [ 6.982670] __kasan_kmalloc+0xd4/0xd8
> [ 6.986420] __kmalloc_noprof+0x194/0x540
> [ 6.990432] framebuffer_alloc+0xc8/0x130
> [ 6.994444] simplefb_probe+0x258/0x2378
> ...
> [ 7.054356]
> [ 7.055838] Freed by task 227:
> [ 7.058891] kasan_save_stack+0x3c/0x70
> [ 7.062727] kasan_save_track+0x20/0x40
> [ 7.066565] kasan_save_free_info+0x4c/0x80
> [ 7.070751] __kasan_slab_free+0x6c/0xa0
> [ 7.074675] kfree+0x10c/0x380
> [ 7.077727] framebuffer_release+0x5c/0x90
> [ 7.081826] simplefb_destroy+0x1b4/0x2c0
> [ 7.085837] put_fb_info+0x98/0x100
> [ 7.089326] unregister_framebuffer+0x178/0x320
> [ 7.093861] simplefb_remove+0x3c/0x60
> [ 7.097611] platform_remove+0x60/0x98
> [ 7.101361] device_remove+0xb8/0x160
> [ 7.105024] device_release_driver_internal+0x2fc/0x470
> [ 7.110256] device_release_driver+0x20/0x38
> [ 7.114529] bus_remove_device+0x1b0/0x380
> [ 7.118628] device_del+0x314/0x820
> [ 7.122116] platform_device_del+0x3c/0x1e8
> [ 7.126302] platform_device_unregister+0x20/0x50
> [ 7.131012] aperture_detach_platform_device+0x1c/0x30
> [ 7.136157] aperture_detach_devices+0x16c/0x290
> [ 7.140779] aperture_remove_conflicting_devices+0x34/0x50
> ...
>
> Reported-by: Daniel Huhardeaux <tech@tootai.net>
> Cc: stable@vger.kernel.org
> Fixes: 92a511a568e44 ("fbdev/simplefb: Add support for generic power-domains")
> Signed-off-by: Janne Grunau <j@jannau.net>
> ---
> Changes in v3:
> - release power-domains on probe errors
> - set par->num_genpds when it's <= 1
> - set par->num_genpds to 0 after detaching
> - Link to v2: https://lore.kernel.org/r/20250908-simplefb-genpd-uaf-v2-1-f88a0d9d880f@jannau.net
>
> Changes in v2:
> - reworked change due to missed use of `par->num_genpds` before setting
> it. Missed in testing due to mixing up FB_SIMPLE and SYSFB_SIMPLEFB.
> - Link to v1: https://lore.kernel.org/r/20250901-simplefb-genpd-uaf-v1-1-0d9f3a34c4dc@jannau.net
> ---
> drivers/video/fbdev/simplefb.c | 31 +++++++++++++++++++++++--------
> 1 file changed, 23 insertions(+), 8 deletions(-)
applied to fbdev git tree.
Thanks!
Helge
PS: Janne, if you want to push yourself via drm-misc, just let me know and I drop it...
^ permalink raw reply
* Re: [PATCH] fbdev: s3fb: revert mclk stop in suspend
From: Helge Deller @ 2025-09-30 18:55 UTC (permalink / raw)
To: Zsolt Kajtar, linux-fbdev
In-Reply-To: <20250903191415.5048-1-soci@c64.rulez.org>
On 9/3/25 21:14, Zsolt Kajtar wrote:
> There are systems which want to wait for as long as it takes for the
> stopped video memory to answer. Mapping it out helps to avoid that
> while the system is running but standby still hangs somehow. So just
> leave the memory on in standby same as it was before my change.
>
> Signed-off-by: Zsolt Kajtar <soci@c64.rulez.org>
> ---
> drivers/video/fbdev/s3fb.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
applied.
Thanks!
Helge
^ permalink raw reply
* Re: [PATCH] fbdev: mb862xxfb: Use int type to store negative error codes
From: Helge Deller @ 2025-09-30 18:43 UTC (permalink / raw)
To: Qianfeng Rong, Thomas Zimmermann, Uwe Kleine-König,
linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <20250830124703.73732-1-rongqianfeng@vivo.com>
On 8/30/25 14:47, Qianfeng Rong wrote:
> Change the 'ret' variable in of_platform_mb862xx_probe() from unsigned long
> to int, as it needs to store either negative error codes or zero.
>
> Storing the negative error codes in unsigned type, doesn't cause an issue
> at runtime but can be confusing. Additionally, assigning negative error
> codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
> flag is enabled.
>
> No effect on runtime.
>
> Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
> ---
> drivers/video/fbdev/mb862xx/mb862xxfbdrv.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
applied.
Thanks!
Helge
^ permalink raw reply
* [PATCH] ARM: spitz: Do not include <linux/fb.h>
From: Thomas Zimmermann @ 2025-09-30 11:26 UTC (permalink / raw)
To: daniel, haojian.zhuang, robert.jarzmik, linux
Cc: linux-arm-kernel, linux-kernel, linux-fbdev, dri-devel,
Thomas Zimmermann
This ARM architecture's source file does not require <linux/fb.h>.
Remove the include statement.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
arch/arm/mach-pxa/spitz.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arm/mach-pxa/spitz.h b/arch/arm/mach-pxa/spitz.h
index 04828d8918aa..873844194a31 100644
--- a/arch/arm/mach-pxa/spitz.h
+++ b/arch/arm/mach-pxa/spitz.h
@@ -12,7 +12,6 @@
#endif
#include "irqs.h" /* PXA_NR_BUILTIN_GPIO, PXA_GPIO_TO_IRQ */
-#include <linux/fb.h>
/* Spitz/Akita GPIOs */
--
2.51.0
^ permalink raw reply related
* Re: [PATCH] fbdev: udlfb: make CONFIG_FB_DEVICE optional
From: David Hunter @ 2025-09-28 23:29 UTC (permalink / raw)
To: kernel test robot, Sukrut Heroorkar, Helge Deller,
Bernie Thompson, Thomas Zimmermann, Arnd Bergmann, Randy Dunlap,
Bartosz Golaszewski, Zsolt Kajtar, Gonzalo Silvalde Blanco,
linux-fbdev, dri-devel, linux-kernel
Cc: llvm, oe-kbuild-all, skhan
In-Reply-To: <202509272320.3K8kdDCw-lkp@intel.com>
On 9/27/25 12:12, kernel test robot wrote:
> Hi Sukrut,
>
> kernel test robot noticed the following build errors:
>
Did you compile and test this code before submitting this patch?
^ permalink raw reply
* Re: [PATCH] fbdev: udlfb: make CONFIG_FB_DEVICE optional
From: kernel test robot @ 2025-09-27 16:12 UTC (permalink / raw)
To: Sukrut Heroorkar, Helge Deller, Bernie Thompson,
Thomas Zimmermann, Arnd Bergmann, Randy Dunlap,
Bartosz Golaszewski, Zsolt Kajtar, Gonzalo Silvalde Blanco,
linux-fbdev, dri-devel, linux-kernel
Cc: llvm, oe-kbuild-all, skhan, david.hunter.linux
In-Reply-To: <20250924175743.6790-1-hsukrut3@gmail.com>
Hi Sukrut,
kernel test robot noticed the following build errors:
[auto build test ERROR on drm-misc/drm-misc-next]
[also build test ERROR on linus/master v6.17-rc7 next-20250926]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Sukrut-Heroorkar/fbdev-udlfb-make-CONFIG_FB_DEVICE-optional/20250925-015939
base: git://anongit.freedesktop.org/drm/drm-misc drm-misc-next
patch link: https://lore.kernel.org/r/20250924175743.6790-1-hsukrut3%40gmail.com
patch subject: [PATCH] fbdev: udlfb: make CONFIG_FB_DEVICE optional
config: x86_64-randconfig-001-20250927 (https://download.01.org/0day-ci/archive/20250927/202509272320.3K8kdDCw-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250927/202509272320.3K8kdDCw-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509272320.3K8kdDCw-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/video/fbdev/udlfb.c:345:16: error: no member named 'dev' in 'struct fb_info'
345 | dev_dbg(info->dev, "mmap() framebuffer addr:%lu size:%lu\n",
| ~~~~ ^
include/linux/dev_printk.h:171:28: note: expanded from macro 'dev_dbg'
171 | dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~
include/linux/dev_printk.h:139:23: note: expanded from macro 'dev_no_printk'
139 | _dev_printk(level, dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:933:16: error: no member named 'dev' in 'struct fb_info'
933 | dev_dbg(info->dev, "open, user=%d fb_info=%p count=%d\n",
| ~~~~ ^
include/linux/dev_printk.h:171:28: note: expanded from macro 'dev_dbg'
171 | dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~
include/linux/dev_printk.h:139:23: note: expanded from macro 'dev_no_printk'
139 | _dev_printk(level, dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:986:16: error: no member named 'dev' in 'struct fb_info'
986 | dev_dbg(info->dev, "release, user=%d count=%d\n", user, dlfb->fb_count);
| ~~~~ ^
include/linux/dev_printk.h:171:28: note: expanded from macro 'dev_dbg'
171 | dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~
include/linux/dev_printk.h:139:23: note: expanded from macro 'dev_no_printk'
139 | _dev_printk(level, dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:1099:16: error: no member named 'dev' in 'struct fb_info'
1099 | dev_dbg(info->dev, "blank, mode %d --> %d\n",
| ~~~~ ^
include/linux/dev_printk.h:171:28: note: expanded from macro 'dev_dbg'
171 | dev_no_printk(KERN_DEBUG, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~
include/linux/dev_printk.h:139:23: note: expanded from macro 'dev_no_printk'
139 | _dev_printk(level, dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:1193:18: error: no member named 'dev' in 'struct fb_info'
1193 | dev_err(info->dev, "Virtual framebuffer alloc failed\n");
| ~~~~ ^
include/linux/dev_printk.h:154:44: note: expanded from macro 'dev_err'
154 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~
include/linux/dev_printk.h:110:11: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:1217:19: error: no member named 'dev' in 'struct fb_info'
1217 | dev_info(info->dev,
| ~~~~ ^
include/linux/dev_printk.h:160:46: note: expanded from macro 'dev_info'
160 | dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~
include/linux/dev_printk.h:110:11: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:1251:12: error: no member named 'dev' in 'struct fb_info'
1251 | if (info->dev) {
| ~~~~ ^
drivers/video/fbdev/udlfb.c:1255:15: error: no member named 'dev' in 'struct fb_info'
1255 | dev = info->dev;
| ~~~~ ^
drivers/video/fbdev/udlfb.c:1379:12: error: no member named 'dev' in 'struct fb_info'
1379 | if (info->dev)
| ~~~~ ^
drivers/video/fbdev/udlfb.c:1720:40: error: no member named 'dev' in 'struct fb_info'
1720 | retval = device_create_bin_file(info->dev, &edid_attr);
| ~~~~ ^
drivers/video/fbdev/udlfb.c:1727:19: error: no member named 'dev' in 'struct fb_info'
1727 | dev_name(info->dev), info->var.xres, info->var.yres,
| ~~~~ ^
include/linux/dev_printk.h:160:67: note: expanded from macro 'dev_info'
160 | dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
drivers/video/fbdev/udlfb.c:1767:31: error: no member named 'dev' in 'struct fb_info'
1767 | device_remove_bin_file(info->dev, &edid_attr);
| ~~~~ ^
12 errors generated.
vim +345 drivers/video/fbdev/udlfb.c
59277b679f8b5c drivers/staging/udlfb/udlfb.c Bernie Thompson 2009-11-24 323
4574203f45eb26 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 324 static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 325 {
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 326 unsigned long start = vma->vm_start;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 327 unsigned long size = vma->vm_end - vma->vm_start;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 328 unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 329 unsigned long page, pos;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 330
5905585103276b drivers/video/fbdev/udlfb.c Thomas Zimmermann 2022-04-29 331 if (info->fbdefio)
5905585103276b drivers/video/fbdev/udlfb.c Thomas Zimmermann 2022-04-29 332 return fb_deferred_io_mmap(info, vma);
5905585103276b drivers/video/fbdev/udlfb.c Thomas Zimmermann 2022-04-29 333
76f92201b821dd drivers/video/fbdev/udlfb.c Thomas Zimmermann 2023-11-27 334 vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);
76f92201b821dd drivers/video/fbdev/udlfb.c Thomas Zimmermann 2023-11-27 335
04f8afbec37f63 drivers/video/udlfb.c Tomi Valkeinen 2013-04-18 336 if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
04f8afbec37f63 drivers/video/udlfb.c Tomi Valkeinen 2013-04-18 337 return -EINVAL;
04f8afbec37f63 drivers/video/udlfb.c Tomi Valkeinen 2013-04-18 338 if (size > info->fix.smem_len)
04f8afbec37f63 drivers/video/udlfb.c Tomi Valkeinen 2013-04-18 339 return -EINVAL;
04f8afbec37f63 drivers/video/udlfb.c Tomi Valkeinen 2013-04-18 340 if (offset > info->fix.smem_len - size)
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 341 return -EINVAL;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 342
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 343 pos = (unsigned long)info->fix.smem_start + offset;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 344
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 @345 dev_dbg(info->dev, "mmap() framebuffer addr:%lu size:%lu\n",
2685cffa9e7992 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 346 pos, size);
2685cffa9e7992 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 347
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 348 while (size > 0) {
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 349 page = vmalloc_to_pfn((void *)pos);
f05e0575ed334a drivers/staging/udlfb/udlfb.c Greg Kroah-Hartman 2009-06-03 350 if (remap_pfn_range(vma, start, page, PAGE_SIZE, PAGE_SHARED))
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 351 return -EAGAIN;
f05e0575ed334a drivers/staging/udlfb/udlfb.c Greg Kroah-Hartman 2009-06-03 352
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 353 start += PAGE_SIZE;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 354 pos += PAGE_SIZE;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 355 if (size > PAGE_SIZE)
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 356 size -= PAGE_SIZE;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 357 else
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 358 size = 0;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 359 }
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 360
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 361 return 0;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 362 }
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 363
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
From: Albin Babu Varghese @ 2025-09-27 7:50 UTC (permalink / raw)
To: Simona Vetter, Helge Deller
Cc: Albin Babu Varghese, syzbot+48b0652a95834717f190, linux-fbdev,
dri-devel, linux-kernel
KASAN reports vmalloc-out-of-bounds writes in sys_imageblit during console
resize operations. The crash happens when bit_putcs renders characters
outside the allocated framebuffer region.
Call trace: vc_do_resize -> clear_selection -> invert_screen ->
do_update_region -> fbcon_putcs -> bit_putcs -> sys_imageblit
The console resize changes dimensions but bit_putcs doesn't validate that
the character positions fit within the framebuffer before rendering.
This causes writes past the allocated buffer in fb_imageblit functions.
Fix by checking bounds before rendering:
- Return if dy + height > yres (would write past bottom)
- Break if dx + width > xres (would write past right edge)
Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
---
drivers/video/fbdev/core/bitblit.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index f9475c14f733..4c732284384a 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -160,6 +160,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
image.height = vc->vc_font.height;
image.depth = 1;
+ if (image.dy + image.height > info->var.yres)
+ return;
+
if (attribute) {
buf = kmalloc(cellsize, GFP_ATOMIC);
if (!buf)
@@ -173,6 +176,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
cnt = count;
image.width = vc->vc_font.width * cnt;
+
+ if (image.dx + image.width > info->var.xres)
+ break;
+
pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
pitch &= ~scan_align;
size = pitch * image.height + buf_align;
--
2.51.0
^ permalink raw reply related
* Re: [PATCH] fbdev: udlfb: make CONFIG_FB_DEVICE optional
From: kernel test robot @ 2025-09-26 20:58 UTC (permalink / raw)
To: Sukrut Heroorkar, Helge Deller, Bernie Thompson,
Thomas Zimmermann, Arnd Bergmann, Randy Dunlap,
Bartosz Golaszewski, Zsolt Kajtar, Gonzalo Silvalde Blanco,
linux-fbdev, dri-devel, linux-kernel
Cc: oe-kbuild-all, skhan, david.hunter.linux
In-Reply-To: <20250924175743.6790-1-hsukrut3@gmail.com>
Hi Sukrut,
kernel test robot noticed the following build warnings:
[auto build test WARNING on drm-misc/drm-misc-next]
[also build test WARNING on linus/master v6.17-rc7 next-20250926]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Sukrut-Heroorkar/fbdev-udlfb-make-CONFIG_FB_DEVICE-optional/20250925-015939
base: git://anongit.freedesktop.org/drm/drm-misc drm-misc-next
patch link: https://lore.kernel.org/r/20250924175743.6790-1-hsukrut3%40gmail.com
patch subject: [PATCH] fbdev: udlfb: make CONFIG_FB_DEVICE optional
config: x86_64-randconfig-075-20250927 (https://download.01.org/0day-ci/archive/20250927/202509270454.lBuADO4l-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250927/202509270454.lBuADO4l-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509270454.lBuADO4l-lkp@intel.com/
All warnings (new ones prefixed by >>):
933 | dev_dbg(info->dev, "open, user=%d fb_info=%p count=%d\n",
| ^~
include/linux/dynamic_debug.h:224:29: note: in definition of macro '__dynamic_func_call_cls'
224 | func(&id, ##__VA_ARGS__); \
| ^~~~~~~~~~~
include/linux/dynamic_debug.h:250:9: note: in expansion of macro '_dynamic_func_call_cls'
250 | _dynamic_func_call_cls(_DPRINTK_CLASS_DFLT, fmt, func, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~~
include/linux/dynamic_debug.h:273:9: note: in expansion of macro '_dynamic_func_call'
273 | _dynamic_func_call(fmt, __dynamic_dev_dbg, \
| ^~~~~~~~~~~~~~~~~~
include/linux/dev_printk.h:165:9: note: in expansion of macro 'dynamic_dev_dbg'
165 | dynamic_dev_dbg(dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/udlfb.c:933:9: note: in expansion of macro 'dev_dbg'
933 | dev_dbg(info->dev, "open, user=%d fb_info=%p count=%d\n",
| ^~~~~~~
drivers/video/fbdev/udlfb.c: In function 'dlfb_ops_release':
drivers/video/fbdev/udlfb.c:986:21: error: 'struct fb_info' has no member named 'dev'
986 | dev_dbg(info->dev, "release, user=%d count=%d\n", user, dlfb->fb_count);
| ^~
include/linux/dynamic_debug.h:224:29: note: in definition of macro '__dynamic_func_call_cls'
224 | func(&id, ##__VA_ARGS__); \
| ^~~~~~~~~~~
include/linux/dynamic_debug.h:250:9: note: in expansion of macro '_dynamic_func_call_cls'
250 | _dynamic_func_call_cls(_DPRINTK_CLASS_DFLT, fmt, func, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~~
include/linux/dynamic_debug.h:273:9: note: in expansion of macro '_dynamic_func_call'
273 | _dynamic_func_call(fmt, __dynamic_dev_dbg, \
| ^~~~~~~~~~~~~~~~~~
include/linux/dev_printk.h:165:9: note: in expansion of macro 'dynamic_dev_dbg'
165 | dynamic_dev_dbg(dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/udlfb.c:986:9: note: in expansion of macro 'dev_dbg'
986 | dev_dbg(info->dev, "release, user=%d count=%d\n", user, dlfb->fb_count);
| ^~~~~~~
drivers/video/fbdev/udlfb.c: In function 'dlfb_ops_blank':
drivers/video/fbdev/udlfb.c:1099:21: error: 'struct fb_info' has no member named 'dev'
1099 | dev_dbg(info->dev, "blank, mode %d --> %d\n",
| ^~
include/linux/dynamic_debug.h:224:29: note: in definition of macro '__dynamic_func_call_cls'
224 | func(&id, ##__VA_ARGS__); \
| ^~~~~~~~~~~
include/linux/dynamic_debug.h:250:9: note: in expansion of macro '_dynamic_func_call_cls'
250 | _dynamic_func_call_cls(_DPRINTK_CLASS_DFLT, fmt, func, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~~
include/linux/dynamic_debug.h:273:9: note: in expansion of macro '_dynamic_func_call'
273 | _dynamic_func_call(fmt, __dynamic_dev_dbg, \
| ^~~~~~~~~~~~~~~~~~
include/linux/dev_printk.h:165:9: note: in expansion of macro 'dynamic_dev_dbg'
165 | dynamic_dev_dbg(dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~
drivers/video/fbdev/udlfb.c:1099:9: note: in expansion of macro 'dev_dbg'
1099 | dev_dbg(info->dev, "blank, mode %d --> %d\n",
| ^~~~~~~
In file included from include/linux/device.h:15,
from include/linux/usb.h:19,
from drivers/video/fbdev/udlfb.c:19:
drivers/video/fbdev/udlfb.c: In function 'dlfb_realloc_framebuffer':
drivers/video/fbdev/udlfb.c:1193:37: error: 'struct fb_info' has no member named 'dev'
1193 | dev_err(info->dev, "Virtual framebuffer alloc failed\n");
| ^~
include/linux/dev_printk.h:110:25: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:1193:25: note: in expansion of macro 'dev_err'
1193 | dev_err(info->dev, "Virtual framebuffer alloc failed\n");
| ^~~~~~~
drivers/video/fbdev/udlfb.c:1217:38: error: 'struct fb_info' has no member named 'dev'
1217 | dev_info(info->dev,
| ^~
include/linux/dev_printk.h:110:25: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/video/fbdev/udlfb.c:1217:25: note: in expansion of macro 'dev_info'
1217 | dev_info(info->dev,
| ^~~~~~~~
drivers/video/fbdev/udlfb.c: In function 'dlfb_setup_modes':
drivers/video/fbdev/udlfb.c:1251:17: error: 'struct fb_info' has no member named 'dev'
1251 | if (info->dev) {
| ^~
drivers/video/fbdev/udlfb.c:1255:27: error: 'struct fb_info' has no member named 'dev'
1255 | dev = info->dev;
| ^~
drivers/video/fbdev/udlfb.c:1379:17: error: 'struct fb_info' has no member named 'dev'
1379 | if (info->dev)
| ^~
drivers/video/fbdev/udlfb.c: In function 'dlfb_usb_probe':
drivers/video/fbdev/udlfb.c:1720:45: error: 'struct fb_info' has no member named 'dev'
1720 | retval = device_create_bin_file(info->dev, &edid_attr);
| ^~
drivers/video/fbdev/udlfb.c:1727:31: error: 'struct fb_info' has no member named 'dev'
1727 | dev_name(info->dev), info->var.xres, info->var.yres,
| ^~
include/linux/dev_printk.h:110:37: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
drivers/video/fbdev/udlfb.c:1725:9: note: in expansion of macro 'dev_info'
1725 | dev_info(info->device,
| ^~~~~~~~
>> drivers/video/fbdev/udlfb.c:1605:40: warning: unused variable 'attr' [-Wunused-variable]
1605 | const struct device_attribute *attr;
| ^~~~
>> drivers/video/fbdev/udlfb.c:1604:13: warning: unused variable 'i' [-Wunused-variable]
1604 | int i;
| ^
drivers/video/fbdev/udlfb.c: In function 'dlfb_usb_disconnect':
drivers/video/fbdev/udlfb.c:1767:36: error: 'struct fb_info' has no member named 'dev'
1767 | device_remove_bin_file(info->dev, &edid_attr);
| ^~
drivers/video/fbdev/udlfb.c:1746:13: warning: unused variable 'i' [-Wunused-variable]
1746 | int i;
| ^
drivers/video/fbdev/udlfb.c: At top level:
>> drivers/video/fbdev/udlfb.c:1468:16: warning: 'metrics_reset_store' defined but not used [-Wunused-function]
1468 | static ssize_t metrics_reset_store(struct device *fbdev,
| ^~~~~~~~~~~~~~~~~~~
vim +/attr +1605 drivers/video/fbdev/udlfb.c
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1467
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 @1468 static ssize_t metrics_reset_store(struct device *fbdev,
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1469 struct device_attribute *attr,
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1470 const char *buf, size_t count)
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1471 {
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1472 struct fb_info *fb_info = dev_get_drvdata(fbdev);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1473 struct dlfb_data *dlfb = fb_info->par;
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1474
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1475 atomic_set(&dlfb->bytes_rendered, 0);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1476 atomic_set(&dlfb->bytes_identical, 0);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1477 atomic_set(&dlfb->bytes_sent, 0);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1478 atomic_set(&dlfb->cpu_kcycles_used, 0);
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1479
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1480 return count;
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1481 }
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1482
598b2eedfc3fbe drivers/video/fbdev/udlfb.c Bhumika Goyal 2017-08-18 1483 static const struct bin_attribute edid_attr = {
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1484 .attr.name = "edid",
8ef8cc4fca4a92 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1485 .attr.mode = 0666,
b9f03a3cd06c6f drivers/video/udlfb.c Paul Mundt 2011-01-06 1486 .size = EDID_LENGTH,
2fbe82037ab251 drivers/video/fbdev/udlfb.c Thomas Weißschuh 2025-05-30 1487 .read = edid_show,
2fbe82037ab251 drivers/video/fbdev/udlfb.c Thomas Weißschuh 2025-05-30 1488 .write = edid_store
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1489 };
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1490
00bab805c21a22 drivers/video/fbdev/udlfb.c Sukrut Heroorkar 2025-09-24 1491 #ifdef CONFIG_FB_DEVICE
fa738a5c4b2a6b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1492 static const struct device_attribute fb_device_attrs[] = {
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1493 __ATTR_RO(metrics_bytes_rendered),
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1494 __ATTR_RO(metrics_bytes_identical),
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1495 __ATTR_RO(metrics_bytes_sent),
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1496 __ATTR_RO(metrics_cpu_kcycles_used),
926c11151e3b82 drivers/staging/udlfb/udlfb.c Greg Kroah-Hartman 2010-11-18 1497 __ATTR(metrics_reset, S_IWUSR, NULL, metrics_reset_store),
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1498 };
00bab805c21a22 drivers/video/fbdev/udlfb.c Sukrut Heroorkar 2025-09-24 1499 #endif
7d9485e2c53caa drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1500
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1501 /*
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1502 * This is necessary before we can communicate with the display controller.
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1503 */
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1504 static int dlfb_select_std_channel(struct dlfb_data *dlfb)
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1505 {
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1506 int ret;
45f580c42e5c12 drivers/video/fbdev/udlfb.c Maksim Salau 2017-05-02 1507 static const u8 set_def_chn[] = {
45f580c42e5c12 drivers/video/fbdev/udlfb.c Maksim Salau 2017-05-02 1508 0x57, 0xCD, 0xDC, 0xA7,
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1509 0x1C, 0x88, 0x5E, 0x15,
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1510 0x60, 0xFE, 0xC6, 0x97,
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1511 0x16, 0x3D, 0x47, 0xF2 };
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1512
537adba4083ed8 drivers/video/fbdev/udlfb.c Helge Deller 2023-05-19 1513 ret = usb_control_msg_send(dlfb->udev, 0, NR_USB_REQUEST_CHANNEL,
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1514 (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0,
537adba4083ed8 drivers/video/fbdev/udlfb.c Helge Deller 2023-05-19 1515 &set_def_chn, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT,
537adba4083ed8 drivers/video/fbdev/udlfb.c Helge Deller 2023-05-19 1516 GFP_KERNEL);
45f580c42e5c12 drivers/video/fbdev/udlfb.c Maksim Salau 2017-05-02 1517
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1518 return ret;
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1519 }
cc403dc67d10b8 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1520
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1521 static int dlfb_parse_vendor_descriptor(struct dlfb_data *dlfb,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1522 struct usb_interface *intf)
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1523 {
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1524 char *desc;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1525 char *buf;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1526 char *desc_end;
f63cb8d7aa31e7 drivers/video/fbdev/udlfb.c Alexey Klimov 2015-06-08 1527 int total_len;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1528
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1529 buf = kzalloc(MAX_VENDOR_DESCRIPTOR_SIZE, GFP_KERNEL);
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1530 if (!buf)
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1531 return false;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1532 desc = buf;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1533
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1534 total_len = usb_get_descriptor(interface_to_usbdev(intf),
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1535 0x5f, /* vendor specific */
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1536 0, desc, MAX_VENDOR_DESCRIPTOR_SIZE);
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1537
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1538 /* if not found, look in configuration descriptor */
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1539 if (total_len < 0) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1540 if (0 == usb_get_extra_descriptor(intf->cur_altsetting,
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1541 0x5f, &desc))
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1542 total_len = (int) desc[0];
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1543 }
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1544
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1545 if (total_len > 5) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1546 dev_info(&intf->dev,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1547 "vendor descriptor length: %d data: %11ph\n",
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1548 total_len, desc);
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1549
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1550 if ((desc[0] != total_len) || /* descriptor length */
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1551 (desc[1] != 0x5f) || /* vendor descriptor type */
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1552 (desc[2] != 0x01) || /* version (2 bytes) */
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1553 (desc[3] != 0x00) ||
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1554 (desc[4] != total_len - 2)) /* length after type */
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1555 goto unrecognized;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1556
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1557 desc_end = desc + total_len;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1558 desc += 5; /* the fixed header we've already parsed */
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1559
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1560 while (desc < desc_end) {
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1561 u8 length;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1562 u16 key;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1563
115e77597efcc9 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-03-12 1564 key = *desc++;
115e77597efcc9 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-03-12 1565 key |= (u16)*desc++ << 8;
115e77597efcc9 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-03-12 1566 length = *desc++;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1567
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1568 switch (key) {
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1569 case 0x0200: { /* max_area */
115e77597efcc9 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-03-12 1570 u32 max_area = *desc++;
115e77597efcc9 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-03-12 1571 max_area |= (u32)*desc++ << 8;
115e77597efcc9 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-03-12 1572 max_area |= (u32)*desc++ << 16;
115e77597efcc9 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-03-12 1573 max_area |= (u32)*desc++ << 24;
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1574 dev_warn(&intf->dev,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1575 "DL chip limited to %d pixel modes\n",
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1576 max_area);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1577 dlfb->sku_pixel_limit = max_area;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1578 break;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1579 }
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1580 default:
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1581 break;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1582 }
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1583 desc += length;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1584 }
f2e1fc9d5d12fb drivers/video/udlfb.c Andrew Kephart 2011-08-21 1585 } else {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1586 dev_info(&intf->dev, "vendor descriptor not available (%d)\n",
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1587 total_len);
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1588 }
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1589
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1590 goto success;
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1591
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1592 unrecognized:
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1593 /* allow udlfb to load for now even if firmware unrecognized */
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1594 dev_err(&intf->dev, "Unrecognized vendor firmware descriptor\n");
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1595
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1596 success:
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1597 kfree(buf);
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1598 return true;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1599 }
8d21547d3c9c3b drivers/video/udlfb.c Bernie Thompson 2012-03-01 1600
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1601 static int dlfb_usb_probe(struct usb_interface *intf,
59277b679f8b5c drivers/staging/udlfb/udlfb.c Bernie Thompson 2009-11-24 1602 const struct usb_device_id *id)
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1603 {
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 @1604 int i;
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 @1605 const struct device_attribute *attr;
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1606 struct dlfb_data *dlfb;
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1607 struct fb_info *info;
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1608 int retval;
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1609 struct usb_device *usbdev = interface_to_usbdev(intf);
ed9de4ed398757 drivers/video/fbdev/udlfb.c Alan Stern 2023-05-19 1610 static u8 out_ep[] = {OUT_EP_NUM + USB_DIR_OUT, 0};
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1611
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1612 /* usb initialization */
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1613 dlfb = kzalloc(sizeof(*dlfb), GFP_KERNEL);
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1614 if (!dlfb) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1615 dev_err(&intf->dev, "%s: failed to allocate dlfb\n", __func__);
c143a559b073ae drivers/video/fbdev/udlfb.c Dan Carpenter 2018-12-20 1616 return -ENOMEM;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1617 }
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1618
7433914efd584b drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-07-25 1619 INIT_LIST_HEAD(&dlfb->deferred_free);
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1620
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1621 dlfb->udev = usb_get_dev(usbdev);
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1622 usb_set_intfdata(intf, dlfb);
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1623
ed9de4ed398757 drivers/video/fbdev/udlfb.c Alan Stern 2023-05-19 1624 if (!usb_check_bulk_endpoints(intf, out_ep)) {
ed9de4ed398757 drivers/video/fbdev/udlfb.c Alan Stern 2023-05-19 1625 dev_err(&intf->dev, "Invalid DisplayLink device!\n");
ed9de4ed398757 drivers/video/fbdev/udlfb.c Alan Stern 2023-05-19 1626 retval = -EINVAL;
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1627 goto error;
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1628 }
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1629
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1630 dev_dbg(&intf->dev, "console enable=%d\n", console);
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1631 dev_dbg(&intf->dev, "fb_defio enable=%d\n", fb_defio);
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1632 dev_dbg(&intf->dev, "shadow enable=%d\n", shadow);
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1633
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1634 dlfb->sku_pixel_limit = 2048 * 1152; /* default to maximum */
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1635
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1636 if (!dlfb_parse_vendor_descriptor(dlfb, intf)) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1637 dev_err(&intf->dev,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1638 "firmware not recognized, incompatible device?\n");
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1639 retval = -ENODEV;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1640 goto error;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1641 }
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1642
664c5f18490f25 drivers/video/udlfb.c Ben Collins 2012-03-03 1643 if (pixel_limit) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1644 dev_warn(&intf->dev,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1645 "DL chip limit of %d overridden to %d\n",
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1646 dlfb->sku_pixel_limit, pixel_limit);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1647 dlfb->sku_pixel_limit = pixel_limit;
664c5f18490f25 drivers/video/udlfb.c Ben Collins 2012-03-03 1648 }
664c5f18490f25 drivers/video/udlfb.c Ben Collins 2012-03-03 1649
664c5f18490f25 drivers/video/udlfb.c Ben Collins 2012-03-03 1650
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1651 /* allocates framebuffer driver structure, not framebuffer memory */
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1652 info = framebuffer_alloc(0, &dlfb->udev->dev);
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1653 if (!info) {
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1654 retval = -ENOMEM;
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1655 goto error;
aaf7dbe07385e0 drivers/video/fbdev/udlfb.c Pavel Skripkin 2022-03-22 1656 }
33077b8d3042e0 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1657
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1658 dlfb->info = info;
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1659 info->par = dlfb;
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1660 info->pseudo_palette = dlfb->pseudo_palette;
2c29cfc3eaf117 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-07-25 1661 dlfb->ops = dlfb_ops;
2c29cfc3eaf117 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-07-25 1662 info->fbops = &dlfb->ops;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1663
babc250e278eac drivers/video/fbdev/udlfb.c Mikulas Patocka 2019-04-01 1664 mutex_init(&dlfb->render_mutex);
6b11f9d8433b47 drivers/video/fbdev/udlfb.c Mikulas Patocka 2019-04-01 1665 dlfb_init_damage(dlfb);
6b11f9d8433b47 drivers/video/fbdev/udlfb.c Mikulas Patocka 2019-04-01 1666 spin_lock_init(&dlfb->damage_lock);
6b11f9d8433b47 drivers/video/fbdev/udlfb.c Mikulas Patocka 2019-04-01 1667 INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
6b11f9d8433b47 drivers/video/fbdev/udlfb.c Mikulas Patocka 2019-04-01 1668
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1669 INIT_LIST_HEAD(&info->modelist);
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1670
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1671 if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1672 retval = -ENOMEM;
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1673 dev_err(&intf->dev, "unable to allocate urb list\n");
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1674 goto error;
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1675 }
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1676
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1677 /* We don't register a new USB class. Our client interface is dlfbev */
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1678
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1679 retval = fb_alloc_cmap(&info->cmap, 256, 0);
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1680 if (retval < 0) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1681 dev_err(info->device, "cmap allocation failed: %d\n", retval);
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1682 goto error;
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1683 }
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1684
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1685 retval = dlfb_setup_modes(dlfb, info, NULL, 0);
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1686 if (retval != 0) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1687 dev_err(info->device,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1688 "unable to find common mode for display and adapter\n");
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1689 goto error;
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1690 }
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1691
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1692 /* ready to begin using device */
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1693
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1694 atomic_set(&dlfb->usb_active, 1);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1695 dlfb_select_std_channel(dlfb);
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1696
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1697 dlfb_ops_check_var(&info->var, info);
7433914efd584b drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-07-25 1698 retval = dlfb_ops_set_par(info);
7433914efd584b drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-07-25 1699 if (retval)
7433914efd584b drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-07-25 1700 goto error;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1701
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1702 retval = register_framebuffer(info);
59277b679f8b5c drivers/staging/udlfb/udlfb.c Bernie Thompson 2009-11-24 1703 if (retval < 0) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1704 dev_err(info->device, "unable to register framebuffer: %d\n",
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1705 retval);
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1706 goto error;
7316bc55ed20c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-10 1707 }
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1708
00bab805c21a22 drivers/video/fbdev/udlfb.c Sukrut Heroorkar 2025-09-24 1709 #ifdef CONFIG_FB_DEVICE
94cd1ae2fd251f drivers/video/udlfb.c Liu Yuan 2011-04-18 1710 for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++) {
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1711 attr = &fb_device_attrs[i];
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1712 retval = device_create_file(info->dev, attr);
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1713 if (retval)
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1714 dev_warn(info->device,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1715 "failed to create '%s' attribute: %d\n",
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1716 attr->attr.name, retval);
94cd1ae2fd251f drivers/video/udlfb.c Liu Yuan 2011-04-18 1717 }
00bab805c21a22 drivers/video/fbdev/udlfb.c Sukrut Heroorkar 2025-09-24 1718 #endif
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1719
94cd1ae2fd251f drivers/video/udlfb.c Liu Yuan 2011-04-18 1720 retval = device_create_bin_file(info->dev, &edid_attr);
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1721 if (retval)
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1722 dev_warn(info->device, "failed to create '%s' attribute: %d\n",
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1723 edid_attr.attr.name, retval);
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1724
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 @1725 dev_info(info->device,
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1726 "%s is DisplayLink USB device (%dx%d, %dK framebuffer memory)\n",
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 @1727 dev_name(info->dev), info->var.xres, info->var.yres,
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1728 ((dlfb->backing_buffer) ?
18dffdf8913ab9 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1729 info->fix.smem_len * 2 : info->fix.smem_len) >> 10);
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1730 return 0;
94cd1ae2fd251f drivers/video/udlfb.c Liu Yuan 2011-04-18 1731
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1732 error:
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1733 if (dlfb->info) {
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1734 dlfb_ops_destroy(dlfb->info);
c143a559b073ae drivers/video/fbdev/udlfb.c Dan Carpenter 2018-12-20 1735 } else {
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1736 usb_put_dev(dlfb->udev);
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1737 kfree(dlfb);
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1738 }
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1739 return retval;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1740 }
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1741
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1742 static void dlfb_usb_disconnect(struct usb_interface *intf)
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1743 {
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1744 struct dlfb_data *dlfb;
59277b679f8b5c drivers/staging/udlfb/udlfb.c Bernie Thompson 2009-11-24 1745 struct fb_info *info;
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1746 int i;
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1747
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1748 dlfb = usb_get_intfdata(intf);
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1749 info = dlfb->info;
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1750
5865889fe43194 drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-16 1751 dev_dbg(&intf->dev, "USB disconnect starting\n");
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1752
33077b8d3042e0 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1753 /* we virtualize until all fb clients release. Then we free */
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1754 dlfb->virtualized = true;
33077b8d3042e0 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1755
33077b8d3042e0 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1756 /* When non-active we'll update virtual framebuffer, but no new urbs */
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1757 atomic_set(&dlfb->usb_active, 0);
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1758
8d21547d3c9c3b drivers/video/udlfb.c Bernie Thompson 2012-03-01 1759 /* this function will wait for all in-flight urbs to complete */
7ea46206d1706b drivers/video/fbdev/udlfb.c Ladislav Michl 2018-01-15 1760 dlfb_free_urb_list(dlfb);
8d21547d3c9c3b drivers/video/udlfb.c Bernie Thompson 2012-03-01 1761
00bab805c21a22 drivers/video/fbdev/udlfb.c Sukrut Heroorkar 2025-09-24 1762 #ifdef CONFIG_FB_DEVICE
33077b8d3042e0 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-09-05 1763 /* remove udlfb's sysfs interfaces */
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1764 for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 1765 device_remove_file(info->dev, &fb_device_attrs[i]);
00bab805c21a22 drivers/video/fbdev/udlfb.c Sukrut Heroorkar 2025-09-24 1766 #endif
2469d5dbcafe06 drivers/staging/udlfb/udlfb.c Bernie Thompson 2010-02-15 @1767 device_remove_bin_file(info->dev, &edid_attr);
8d21547d3c9c3b drivers/video/udlfb.c Bernie Thompson 2012-03-01 1768
68a958a915ca91 drivers/video/fbdev/udlfb.c Mikulas Patocka 2018-10-08 1769 unregister_framebuffer(info);
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1770 }
88e58b1a42f8c1 drivers/staging/udlfb/udlfb.c Roberto De Ioris 2009-06-03 1771
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [RFC PATCH] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
From: Thomas Zimmermann @ 2025-09-25 14:47 UTC (permalink / raw)
To: Wang ShaoBo, deller
Cc: leijitang, qianqiang.liu, daniel.vetter, linux-kernel, xiexiuqi,
dri-devel, Linux Fbdev development list
In-Reply-To: <e735d76b-e73a-4f1a-9918-8b0b6b1d8ea1@suse.de>
Am 25.09.25 um 16:24 schrieb Thomas Zimmermann:
> Hi
>
> Am 25.09.25 um 11:15 schrieb Wang ShaoBo:
>> I got some KASAN report as below:
>>
>> BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90
>> Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016
>>
>> CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
>> BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
>> Call Trace:
>> <TASK>
>> dump_stack_lvl+0x72/0xa0
>> print_address_description.constprop.0+0x6b/0x3d0
>> ? fbcon_prepare_logo+0x61e/0xc90
>> print_report+0xba/0x280
>> ? fbcon_prepare_logo+0x61e/0xc90
>> ? kasan_addr_to_slab+0xd/0xa0
>> ? fbcon_prepare_logo+0x61e/0xc90
>> kasan_report+0xaf/0xe0
>> ? fbcon_prepare_logo+0x61e/0xc90
>> kasan_check_range+0x100/0x1c0
>> __asan_memcpy+0x23/0x60
>> fbcon_prepare_logo+0x61e/0xc90
>> fbcon_init+0xeb9/0x1db0
>> ? __pfx_drm_fb_helper_set_par+0x10/0x10
>> visual_init+0x310/0x5c0
>> do_bind_con_driver.isra.0+0x627/0xbd0
>> store_bind+0x60b/0x710
>> ? __pfx_store_bind+0x10/0x10
>> dev_attr_store+0x5a/0x90
>> ? __pfx_dev_attr_store+0x10/0x10
>> sysfs_kf_write+0x145/0x1b0
>> kernfs_fop_write_iter+0x367/0x580
>> ? __pfx_sysfs_kf_write+0x10/0x10
>> new_sync_write+0x1b1/0x2d0
>> ? __pfx_new_sync_write+0x10/0x10
>> ? rb_commit+0x121/0x910
>> ? avc_policy_seqno+0xe/0x20
>> ? selinux_file_permission+0x129/0x5d0
>> ? security_file_permission+0xa8/0x700
>> vfs_write+0x71a/0x960
>> ksys_write+0x12e/0x260
>>
>> fbcon_init()
>> -> vc_resize()
>> //success resize vc_origin buffer size=224=7(cols)*2*16(rows)
>> -> bcon_prepare_logo(vc, info, old_cols, old_rows,
>> new_cols, new_rows)
>> //old_cols=256，old_rows=4，new_cols=7，new_rows=16
>>
>> There happened to be a vc_origin buffer copy overflow error in
>> fbcon_prepare_logo(), scrolling screen down when using old cols
>> after vc resize would trigger out of lower bound of vc_origin buffer.
>>
>> Fixes: 6104c37094e7 ("fbcon: Make fbcon a built-time depency for fbdev")
>
> That's probably not the broken commit. According to 'git blame', the
> broken code dates back to the initial git import. During the pre-git
> days, the change at [1] might be have introduced he issue.
>
> Maybe drop the Fixes tag entirely.
>
> [1]
> https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/?id=458a55138545b8b098feb29aaf2e509f8fbab4b3
>
>> Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
>
> This looks like a sensible change to me, although I can't claim to
> fully understand what the function does.
>
> Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
>
> Best regards
> Thomas
>
>> ---
>> drivers/video/fbdev/core/fbcon.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/video/fbdev/core/fbcon.c
>> b/drivers/video/fbdev/core/fbcon.c
>> index ac3c99ed92d1..6fa81d0297a0 100644
>> --- a/drivers/video/fbdev/core/fbcon.c
>> +++ b/drivers/video/fbdev/core/fbcon.c
>> @@ -610,6 +610,8 @@ static void fbcon_prepare_logo(struct vc_data
>> *vc, struct fb_info *info,
>> /* We can scroll screen down */
>> r = q - step - cols;
>> for (cnt = rows - logo_lines; cnt > 0; cnt--) {
>> + if (r < (unsigned short *) vc->vc_origin)
>> + break;
>> scr_memcpyw(r + step, r, vc->vc_size_row);
>> r -= cols;
>> }
>
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
^ permalink raw reply
* [PATCH] fbdev: udlfb: make CONFIG_FB_DEVICE optional
From: Sukrut Heroorkar @ 2025-09-24 17:57 UTC (permalink / raw)
To: Helge Deller, Bernie Thompson, Thomas Zimmermann, Arnd Bergmann,
Randy Dunlap, Bartosz Golaszewski, Sukrut Heroorkar, Zsolt Kajtar,
Gonzalo Silvalde Blanco, open list:FRAMEBUFFER LAYER,
open list:FRAMEBUFFER LAYER, open list
Cc: skhan, david.hunter.linux
The udlfb driver exposes sysfs attributes thus depends upon
CONFIG_FB_DEVICE. This patch work wraps relavent code blocks
with #ifdef CONFIG_FB_DEVICE so that the driver can still be
built even when CONFIG_FB_DEVICE is not selected.
This addresses an item in Documentation/gpu/TODO.rst.
Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
---
Note: this change has only been compile-tested.
drivers/video/fbdev/Kconfig | 1 -
drivers/video/fbdev/udlfb.c | 8 ++++++++
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 1500dca8c416..40442b80de17 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -1596,7 +1596,6 @@ config FB_SMSCUFX
config FB_UDL
tristate "Displaylink USB Framebuffer support"
depends on FB && USB
- depends on FB_DEVICE
select FB_MODE_HELPERS
select FB_SYSMEM_HELPERS_DEFERRED
help
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index ccede85df1e1..de2e310054d4 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1382,6 +1382,7 @@ static int dlfb_setup_modes(struct dlfb_data *dlfb,
return result;
}
+#ifdef CONFIG_FB_DEVICE
static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
struct device_attribute *a, char *buf) {
struct fb_info *fb_info = dev_get_drvdata(fbdev);
@@ -1413,6 +1414,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
return sysfs_emit(buf, "%u\n",
atomic_read(&dlfb->cpu_kcycles_used));
}
+#endif
static ssize_t edid_show(
struct file *filp,
@@ -1486,6 +1488,7 @@ static const struct bin_attribute edid_attr = {
.write = edid_store
};
+#ifdef CONFIG_FB_DEVICE
static const struct device_attribute fb_device_attrs[] = {
__ATTR_RO(metrics_bytes_rendered),
__ATTR_RO(metrics_bytes_identical),
@@ -1493,6 +1496,7 @@ static const struct device_attribute fb_device_attrs[] = {
__ATTR_RO(metrics_cpu_kcycles_used),
__ATTR(metrics_reset, S_IWUSR, NULL, metrics_reset_store),
};
+#endif
/*
* This is necessary before we can communicate with the display controller.
@@ -1702,6 +1706,7 @@ static int dlfb_usb_probe(struct usb_interface *intf,
goto error;
}
+#ifdef CONFIG_FB_DEVICE
for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++) {
attr = &fb_device_attrs[i];
retval = device_create_file(info->dev, attr);
@@ -1710,6 +1715,7 @@ static int dlfb_usb_probe(struct usb_interface *intf,
"failed to create '%s' attribute: %d\n",
attr->attr.name, retval);
}
+#endif
retval = device_create_bin_file(info->dev, &edid_attr);
if (retval)
@@ -1753,9 +1759,11 @@ static void dlfb_usb_disconnect(struct usb_interface *intf)
/* this function will wait for all in-flight urbs to complete */
dlfb_free_urb_list(dlfb);
+#ifdef CONFIG_FB_DEVICE
/* remove udlfb's sysfs interfaces */
for (i = 0; i < ARRAY_SIZE(fb_device_attrs); i++)
device_remove_file(info->dev, &fb_device_attrs[i]);
+#endif
device_remove_bin_file(info->dev, &edid_attr);
unregister_framebuffer(info);
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] fbcon: Set fb_display[i]->mode to NULL when the mode is released
From: Thomas Zimmermann @ 2025-09-24 9:17 UTC (permalink / raw)
To: Quanmin Yan, simona
Cc: deller, linux-kernel, linux-fbdev, dri-devel, wangkefeng.wang,
zuoze1, sunnanyong
In-Reply-To: <20250923110608.3385083-1-yanquanmin1@huawei.com>
Hi,
thanks for the report.
Am 23.09.25 um 13:06 schrieb Quanmin Yan:
> Recently, we discovered the following issue through syzkaller:
>
> BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0
> Read of size 4 at addr ff11000001b3c69c by task syz.xxx
> ...
> Call Trace:
> <TASK>
> dump_stack_lvl+0xab/0xe0
> print_address_description.constprop.0+0x2c/0x390
> print_report+0xb9/0x280
> kasan_report+0xb8/0xf0
> fb_mode_is_equal+0x285/0x2f0
> fbcon_mode_deleted+0x129/0x180
> fb_set_var+0xe7f/0x11d0
> do_fb_ioctl+0x6a0/0x750
> fb_ioctl+0xe0/0x140
> __x64_sys_ioctl+0x193/0x210
> do_syscall_64+0x5f/0x9c0
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> The issue occurs in the function fb_mode_is_equal(p->mode, mode), I also
> noticed that when freeing the memory related to fb_info->modelist, there's
> no attempt to set the corresponding fb_display[i]->mode to NULL after
> freeing. Based on analysis, the root cause of this bug appears to be that
> a certain p->mode has become a wild pointer.
>
> I've identified two code paths for freeing modelist->mode:
> 1. fb_delete_videomode - removes videomode entry from modelist.
> 2. fb_destroy_modelist - destroys the entire modelist.
What about fb_new_modelist()? [1] It's called from store_modes() and the
whole logic in the caller seems fragile to me. This could leave p->mode
set when it should be cleared; and vice versa.
[1]
https://elixir.bootlin.com/linux/v6.16.8/source/drivers/video/fbdev/core/fbmem.c#L712
[2]
https://elixir.bootlin.com/linux/v6.16.8/source/drivers/video/fbdev/core/fbsysfs.c#L113
>
> Analysis shows that fb_delete_videomode path should have been fixed in
> a previous patch[1]. Therefore, the current bug is likely triggered
> through the fb_destroy_modelist path. I've found a reproducible test case:
> 1. With /dev/fb0 already registered in the system, load a kernel module
> to register a new device /dev/fb1;
> 2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);
> 3. Switch console from fb to VGA (to allow normal rmmod of the ko);
> 4. Unload the kernel module - at this point fb1's modelist is freed, leaving
> a wild pointer in fb_display[];
> 5. Trigger the bug via system calls through fb0 attempting to delete a mode
> from fb0.
>
> To prevent similar issues from recurring, consider traversing fb_display[]
> whenever releasing a mode from fb_info. If the corresponding mode exists
> in fb_display[], set its pointer to NULL.
>
> [1] https://lore.kernel.org/all/20210712085544.2828-1-thunder.leizhen@huawei.com/
>
> Signed-off-by: Quanmin Yan <yanquanmin1@huawei.com>
> ---
> This is my first time working on fb issues. If there are any misunderstandings
> in my analysis, I would appreciate corrections from the community.
>
> drivers/video/fbdev/core/fbcon.c | 11 +++++++++++
> drivers/video/fbdev/core/modedb.c | 7 +++++++
> include/linux/fbcon.h | 2 ++
> 3 files changed, 20 insertions(+)
>
> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index b062b05f4128..bfbf79d6cd05 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -2803,6 +2803,17 @@ int fbcon_mode_deleted(struct fb_info *info,
> return found;
> }
>
> +void fb_display_clean_videomode(struct fb_videomode *m)
Rather fbcon_delete_mode
> +{
> + struct fbcon_display *p;
> +
> + for (int i = first_fb_vc; i <= last_fb_vc; i++) {
I think this code also needs to test the fb_info, or it might clear
another display's mode. See [3] for an example
[3]
https://elixir.bootlin.com/linux/v6.16.8/source/drivers/video/fbdev/core/fbcon.c#L2786
> + p = &fb_display[i];
> + if (p->mode == m)
> + p->mode = NULL;
> + }
> +}
> +
> #ifdef CONFIG_VT_HW_CONSOLE_BINDING
> static void fbcon_unbind(void)
> {
> diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
> index 53a610948c4a..5a0ee96ebefa 100644
> --- a/drivers/video/fbdev/core/modedb.c
> +++ b/drivers/video/fbdev/core/modedb.c
> @@ -16,6 +16,7 @@
> #include <linux/slab.h>
> #include <linux/fb.h>
> #include <linux/kernel.h>
> +#include <linux/fbcon.h>
>
> #undef DEBUG
>
> @@ -1100,6 +1101,7 @@ void fb_delete_videomode(const struct fb_videomode *mode,
> modelist = list_entry(pos, struct fb_modelist, list);
> m = &modelist->mode;
> if (fb_mode_is_equal(m, mode)) {
> + fb_display_clean_videomode(m);
There's only one caller of fb_delete_videomode(). I think this call
should be right before fb_delete_videomode().
> list_del(pos);
> kfree(pos);
> }
> @@ -1113,8 +1115,13 @@ void fb_delete_videomode(const struct fb_videomode *mode,
> void fb_destroy_modelist(struct list_head *head)
> {
> struct list_head *pos, *n;
> + struct fb_modelist *modelist;
> + struct fb_videomode *m;
>
> list_for_each_safe(pos, n, head) {
> + modelist = list_entry(pos, struct fb_modelist, list);
> + m = &modelist->mode;
> + fb_display_clean_videomode(m);
Same here: I think fb_destroy_modelist() should only release the mode.
Clearing the fbcon mode should be done by the caller.
Best regards
Thomas
> list_del(pos);
> kfree(pos);
> }
> diff --git a/include/linux/fbcon.h b/include/linux/fbcon.h
> index 81f0e698acbf..2b5e93aeaaff 100644
> --- a/include/linux/fbcon.h
> +++ b/include/linux/fbcon.h
> @@ -18,6 +18,7 @@ void fbcon_suspended(struct fb_info *info);
> void fbcon_resumed(struct fb_info *info);
> int fbcon_mode_deleted(struct fb_info *info,
> struct fb_videomode *mode);
> +void fb_display_clean_videomode(struct fb_videomode *m);
> void fbcon_new_modelist(struct fb_info *info);
> void fbcon_get_requirement(struct fb_info *info,
> struct fb_blit_caps *caps);
> @@ -38,6 +39,7 @@ static inline void fbcon_suspended(struct fb_info *info) {}
> static inline void fbcon_resumed(struct fb_info *info) {}
> static inline int fbcon_mode_deleted(struct fb_info *info,
> struct fb_videomode *mode) { return 0; }
> +static inline void fb_display_clean_videomode(struct fb_videomode *m) {}
> static inline void fbcon_new_modelist(struct fb_info *info) {}
> static inline void fbcon_get_requirement(struct fb_info *info,
> struct fb_blit_caps *caps) {}
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
^ permalink raw reply
* [PATCH] fbdev: Make drivers depend on LCD_CLASS_DEVICE
From: Thomas Zimmermann @ 2025-09-24 8:33 UTC (permalink / raw)
To: deller, arnd; +Cc: linux-fbdev, dri-devel, Thomas Zimmermann
LCD_CLASS_DEVICE is the user-controlled option that enables the LCD
display subsystem. Do not select it from fbdev drivers. Selecting it
from drivers can lead to cyclic dependencies within the config.
Some guidelines for using select can be found in the kernel docs at [1].
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://elixir.bootlin.com/linux/v6.16/source/Documentation/kbuild/kconfig-language.rst#L147 # [1]
---
drivers/video/fbdev/Kconfig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 6cea1449b4c5..0bea7eae6161 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -126,9 +126,9 @@ config FB_ACORN
config FB_CLPS711X
tristate "CLPS711X LCD support"
depends on FB && (ARCH_CLPS711X || COMPILE_TEST)
+ depends on LCD_CLASS_DEVICE
select FB_IOMEM_HELPERS
select FB_MODE_HELPERS
- select LCD_CLASS_DEVICE
select VIDEOMODE_HELPERS
help
Say Y to enable the Framebuffer driver for the Cirrus Logic
@@ -150,7 +150,7 @@ config FB_IMX
tristate "Freescale i.MX1/21/25/27 LCD support"
depends on FB && HAVE_CLK && HAS_IOMEM
depends on ARCH_MXC || COMPILE_TEST
- select LCD_CLASS_DEVICE
+ depends on LCD_CLASS_DEVICE
select FB_IOMEM_HELPERS
select FB_MODE_HELPERS
select VIDEOMODE_HELPERS
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v2] fbdev/radeon: Remove stale product link in Kconfig/FB_RADEON
From: Thomas Zimmermann @ 2025-09-24 6:30 UTC (permalink / raw)
To: Sukrut Heroorkar, Helge Deller, Arnd Bergmann,
Bartosz Golaszewski, Randy Dunlap, Gonzalo Silvalde Blanco,
open list:FRAMEBUFFER LAYER, open list:FRAMEBUFFER LAYER,
open list
Cc: skhan, david.hunter.linux
In-Reply-To: <20250923171409.25927-1-hsukrut3@gmail.com>
Am 23.09.25 um 19:14 schrieb Sukrut Heroorkar:
> The product page referenced in the FB_RADEON is no longer valid.
> Remove it to avoid pointing to an invalid link.
>
> Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
> ---
> Changes since v1:
> - Dropped the link entirely as suggested
> (See: https://lore.kernel.org/all/CADnq5_NHu5=esJZrgy_S80jF68ZapRRYX4_L70DwDDSN3VXitQ@mail.gmail.com/)
>
> drivers/video/fbdev/Kconfig | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
> index c21484d15f0c..27639b2590d8 100644
> --- a/drivers/video/fbdev/Kconfig
> +++ b/drivers/video/fbdev/Kconfig
> @@ -948,9 +948,6 @@ config FB_RADEON
> a framebuffer device. There are both PCI and AGP versions. You
> don't need to choose this to run the Radeon in plain VGA mode.
>
> - There is a product page at
> - https://products.amd.com/en-us/GraphicCardResult.aspx
> -
> config FB_RADEON_I2C
> bool "DDC/I2C for ATI Radeon support"
> depends on FB_RADEON
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
^ permalink raw reply
* Thematic Funds Letter Of Intent
From: Al Sayyid Sultan @ 2025-09-23 23:54 UTC (permalink / raw)
To: linux-fbdev
To: linux-fbdev@vger.kernel.org
Date: 24-09-2025
Thematic Funds Letter Of Intent
It's a pleasure to connect with you
Having been referred to your investment by my team, we would be
honored to review your available investment projects for onward
referral to my principal investors who can allocate capital for
the financing of it.
kindly advise at your convenience
Best Regards,
Respectfully,
Al Sayyid Sultan Yarub Al Busaidi
Director
^ permalink raw reply
* Re: [PATCH v2] fbdev/radeon: Remove stale product link in Kconfig/FB_RADEON
From: Alex Deucher @ 2025-09-23 21:01 UTC (permalink / raw)
To: Sukrut Heroorkar
Cc: Helge Deller, Thomas Zimmermann, Arnd Bergmann,
Bartosz Golaszewski, Randy Dunlap, Gonzalo Silvalde Blanco,
open list:FRAMEBUFFER LAYER, open list:FRAMEBUFFER LAYER,
open list, skhan, david.hunter.linux
In-Reply-To: <20250923171409.25927-1-hsukrut3@gmail.com>
On Tue, Sep 23, 2025 at 4:19 PM Sukrut Heroorkar <hsukrut3@gmail.com> wrote:
>
> The product page referenced in the FB_RADEON is no longer valid.
> Remove it to avoid pointing to an invalid link.
>
> Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
> ---
> Changes since v1:
> - Dropped the link entirely as suggested
> (See: https://lore.kernel.org/all/CADnq5_NHu5=esJZrgy_S80jF68ZapRRYX4_L70DwDDSN3VXitQ@mail.gmail.com/)
>
> drivers/video/fbdev/Kconfig | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
> index c21484d15f0c..27639b2590d8 100644
> --- a/drivers/video/fbdev/Kconfig
> +++ b/drivers/video/fbdev/Kconfig
> @@ -948,9 +948,6 @@ config FB_RADEON
> a framebuffer device. There are both PCI and AGP versions. You
> don't need to choose this to run the Radeon in plain VGA mode.
>
> - There is a product page at
> - https://products.amd.com/en-us/GraphicCardResult.aspx
> -
> config FB_RADEON_I2C
> bool "DDC/I2C for ATI Radeon support"
> depends on FB_RADEON
> --
> 2.43.0
>
^ permalink raw reply
* [PATCH v2] fbdev/radeon: Remove stale product link in Kconfig/FB_RADEON
From: Sukrut Heroorkar @ 2025-09-23 17:14 UTC (permalink / raw)
To: Helge Deller, Thomas Zimmermann, Arnd Bergmann,
Bartosz Golaszewski, Randy Dunlap, Sukrut Heroorkar,
Gonzalo Silvalde Blanco, open list:FRAMEBUFFER LAYER,
open list:FRAMEBUFFER LAYER, open list
Cc: skhan, david.hunter.linux
The product page referenced in the FB_RADEON is no longer valid.
Remove it to avoid pointing to an invalid link.
Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
---
Changes since v1:
- Dropped the link entirely as suggested
(See: https://lore.kernel.org/all/CADnq5_NHu5=esJZrgy_S80jF68ZapRRYX4_L70DwDDSN3VXitQ@mail.gmail.com/)
drivers/video/fbdev/Kconfig | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index c21484d15f0c..27639b2590d8 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig
@@ -948,9 +948,6 @@ config FB_RADEON
a framebuffer device. There are both PCI and AGP versions. You
don't need to choose this to run the Radeon in plain VGA mode.
- There is a product page at
- https://products.amd.com/en-us/GraphicCardResult.aspx
-
config FB_RADEON_I2C
bool "DDC/I2C for ATI Radeon support"
depends on FB_RADEON
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] fbdev/radeon: Update stale product link in Kconfig/FB_RADEON
From: Alex Deucher @ 2025-09-23 16:03 UTC (permalink / raw)
To: Thomas Zimmermann
Cc: Sukrut Heroorkar, Helge Deller, Arnd Bergmann, Randy Dunlap,
Gonzalo Silvalde Blanco, Bartosz Golaszewski,
open list:FRAMEBUFFER LAYER, open list:FRAMEBUFFER LAYER,
open list, skhan, david.hunter.linux
In-Reply-To: <9fe75192-9260-44f7-8f13-e024e2bbd731@suse.de>
On Tue, Sep 23, 2025 at 11:29 AM Thomas Zimmermann <tzimmermann@suse.de> wrote:
>
> Hi
>
> Am 23.09.25 um 10:41 schrieb Sukrut Heroorkar:
> > The previous Radeon product page link was no longer valid. Repalce
> > it with the current working link.
> >
> > Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
> > ---
> > drivers/video/fbdev/Kconfig | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
> > index c21484d15f0c..3037455adf48 100644
> > --- a/drivers/video/fbdev/Kconfig
> > +++ b/drivers/video/fbdev/Kconfig
> > @@ -949,7 +949,7 @@ config FB_RADEON
> > don't need to choose this to run the Radeon in plain VGA mode.
> >
> > There is a product page at
> > - https://products.amd.com/en-us/GraphicCardResult.aspx
> > + https://www.amd.com/en/products/specifications/graphics.html
>
> May I suggest to remove this URL entirely?
Yes, agreed. I doubt any of the chips listed there actually work with radeonfb.
Alex
>
> Best regards
> Thomas
>
> >
> > config FB_RADEON_I2C
> > bool "DDC/I2C for ATI Radeon support"
>
> --
> --
> Thomas Zimmermann
> Graphics Driver Developer
> SUSE Software Solutions Germany GmbH
> Frankenstrasse 146, 90461 Nuernberg, Germany
> GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
> HRB 36809 (AG Nuernberg)
>
>
^ permalink raw reply
* Re: [PATCH] fbcon: fix buffer overflow in fbcon_set_font
From: Thomas Zimmermann @ 2025-09-23 15:21 UTC (permalink / raw)
To: Simon Richter, linux-fbdev, dri-devel, linux-kernel; +Cc: stable
In-Reply-To: <20250923150642.2441-1-Simon.Richter@hogyros.de>
Hi,
thanks for the patch. The fix at [1] has meanwhile been merged into the
DRM tree.
[1] https://patchwork.freedesktop.org/series/154848/
Best regards
Thomas
Am 23.09.25 um 17:06 schrieb Simon Richter:
> Commit 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe introduced overflow
> checking for the font allocation size calculation, but in doing so moved
> the addition of the size for font housekeeping data out of the kmalloc
> call.
>
> As a result, the calculated size now includes those extra bytes, which
> marks the same number of bytes beyond the allocation as valid font data.
>
> The crc32() call and the later memcmp() in fbcon_set_font() already perform
> an out-of-bounds read, the latter is flagged on ppc64el:
>
> memcmp: detected buffer overflow: 4112 byte read of buffer size 4096
>
> when loading Lat15-Fixed16.psf.gz.
>
> Since the addition of the extra size should only go into the kmalloc()
> call, calculate this size in a separate variable.
>
> Signed-off-by: Simon Richter <Simon.Richter@hogyros.de>
> Fixes: 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font")
> Cc: stable <stable@vger.kernel.org> #v5.9+
> ---
> drivers/video/fbdev/core/fbcon.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index 5fade44931b8..a3fbf42c57d9 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -2518,7 +2518,7 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
> unsigned charcount = font->charcount;
> int w = font->width;
> int h = font->height;
> - int size;
> + int size, allocsize;
> int i, csum;
> u8 *new_data, *data = font->data;
> int pitch = PITCH(font->width);
> @@ -2551,10 +2551,10 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
> return -EINVAL;
>
> /* Check for overflow in allocation size calculation */
> - if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size))
> + if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &allocsize))
> return -EINVAL;
>
> - new_data = kmalloc(size, GFP_USER);
> + new_data = kmalloc(allocsize, GFP_USER);
>
> if (!new_data)
> return -ENOMEM;
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
^ permalink raw reply
* Re: [PATCH] fbdev/radeon: Update stale product link in Kconfig/FB_RADEON
From: Thomas Zimmermann @ 2025-09-23 15:14 UTC (permalink / raw)
To: Sukrut Heroorkar, Helge Deller, Arnd Bergmann, Randy Dunlap,
Gonzalo Silvalde Blanco, Bartosz Golaszewski,
open list:FRAMEBUFFER LAYER, open list:FRAMEBUFFER LAYER,
open list
Cc: skhan, david.hunter.linux
In-Reply-To: <20250923084157.11582-1-hsukrut3@gmail.com>
Hi
Am 23.09.25 um 10:41 schrieb Sukrut Heroorkar:
> The previous Radeon product page link was no longer valid. Repalce
> it with the current working link.
>
> Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
> ---
> drivers/video/fbdev/Kconfig | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
> index c21484d15f0c..3037455adf48 100644
> --- a/drivers/video/fbdev/Kconfig
> +++ b/drivers/video/fbdev/Kconfig
> @@ -949,7 +949,7 @@ config FB_RADEON
> don't need to choose this to run the Radeon in plain VGA mode.
>
> There is a product page at
> - https://products.amd.com/en-us/GraphicCardResult.aspx
> + https://www.amd.com/en/products/specifications/graphics.html
May I suggest to remove this URL entirely?
Best regards
Thomas
>
> config FB_RADEON_I2C
> bool "DDC/I2C for ATI Radeon support"
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
^ permalink raw reply
* Re: [PATCH] fbdev/radeon: Update stale product link in Kconfig/FB_RADEON
From: Thomas Zimmermann @ 2025-09-23 15:14 UTC (permalink / raw)
To: Sukrut Heroorkar, Helge Deller, Arnd Bergmann, Randy Dunlap,
Gonzalo Silvalde Blanco, Bartosz Golaszewski,
open list:FRAMEBUFFER LAYER, open list:FRAMEBUFFER LAYER,
open list
Cc: skhan, david.hunter.linux
In-Reply-To: <20250923084157.11582-1-hsukrut3@gmail.com>
Hi
Am 23.09.25 um 10:41 schrieb Sukrut Heroorkar:
> The previous Radeon product page link was no longer valid. Repalce
> it with the current working link.
>
> Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
> ---
> drivers/video/fbdev/Kconfig | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
> index c21484d15f0c..3037455adf48 100644
> --- a/drivers/video/fbdev/Kconfig
> +++ b/drivers/video/fbdev/Kconfig
> @@ -949,7 +949,7 @@ config FB_RADEON
> don't need to choose this to run the Radeon in plain VGA mode.
>
> There is a product page at
> - https://products.amd.com/en-us/GraphicCardResult.aspx
> + https://www.amd.com/en/products/specifications/graphics.html
May I suggest to remove this URL entirely?
Best regards
Thomas
>
> config FB_RADEON_I2C
> bool "DDC/I2C for ATI Radeon support"
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
^ permalink raw reply
* [PATCH] fbcon: fix buffer overflow in fbcon_set_font
From: Simon Richter @ 2025-09-23 15:06 UTC (permalink / raw)
To: linux-fbdev, dri-devel, linux-kernel; +Cc: Simon Richter, stable
Commit 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe introduced overflow
checking for the font allocation size calculation, but in doing so moved
the addition of the size for font housekeeping data out of the kmalloc
call.
As a result, the calculated size now includes those extra bytes, which
marks the same number of bytes beyond the allocation as valid font data.
The crc32() call and the later memcmp() in fbcon_set_font() already perform
an out-of-bounds read, the latter is flagged on ppc64el:
memcmp: detected buffer overflow: 4112 byte read of buffer size 4096
when loading Lat15-Fixed16.psf.gz.
Since the addition of the extra size should only go into the kmalloc()
call, calculate this size in a separate variable.
Signed-off-by: Simon Richter <Simon.Richter@hogyros.de>
Fixes: 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font")
Cc: stable <stable@vger.kernel.org> #v5.9+
---
drivers/video/fbdev/core/fbcon.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 5fade44931b8..a3fbf42c57d9 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2518,7 +2518,7 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
unsigned charcount = font->charcount;
int w = font->width;
int h = font->height;
- int size;
+ int size, allocsize;
int i, csum;
u8 *new_data, *data = font->data;
int pitch = PITCH(font->width);
@@ -2551,10 +2551,10 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font,
return -EINVAL;
/* Check for overflow in allocation size calculation */
- if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size))
+ if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &allocsize))
return -EINVAL;
- new_data = kmalloc(size, GFP_USER);
+ new_data = kmalloc(allocsize, GFP_USER);
if (!new_data)
return -ENOMEM;
--
2.47.3
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox