* Re: [PATCH] staging: fbtft: use ARRAY_SIZE() in NUMARGS macro
From: Joyeta Modak @ 2026-06-26 8:57 UTC (permalink / raw)
To: Andy Shevchenko
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <ajvAGK-0kCfkThcs@ashevche-desk.local>
Thank you for the feedback and the question.
I checked every write_reg() across all fbtft drivers and found that
the largest number of arguments is 129 in write_reg(par,
MIPI_DCS_WRITE_LUT,...)
As COUNT_ARGS() in args.h only supports up to 15, it is not a safe fit here.
However, the kernel test robot reported a problem with my
implementation as the __must_be_array() check in ARRAY_SIZE() requires
the array to be a compile time constant expression and thus breaks the
call at several places.(example par->bgr)
I tried to reproduce this locally on my system using both GCC and
Clang with ARCH=um on x86_64 but could not reproduce the build
failure.
Since the original sizeof() based approach had no such errors flagged,
I am thinking of dropping the ARRAY_SIZE() approach.
Any other feedback is appreciated. Thanks again.
On Wed, Jun 24, 2026 at 5:01 PM Andy Shevchenko
<andriy.shevchenko@intel.com> wrote:
>
> On Wed, Jun 24, 2026 at 01:08:04PM +0530, Joyeta Modak wrote:
> > NUMARGS() computes the number of arguments by dividing the size of a
> > temporary int array by sizeof(int). Using the standard ARRAY_SIZE()
> > macro is the correct way to count array elements in the kernel, and
> > ARRAY_SIZE() also provides a __must_be_array() compile time check. There
> > are no functional changes.
>
> ...
>
> > -#define NUMARGS(...) (sizeof((int[]){__VA_ARGS__}) / sizeof(int))
> > +#define NUMARGS(...) ARRAY_SIZE(((int[]){__VA_ARGS__}))
> >
> > #define write_reg(par, ...) \
> > ((par)->fbtftops.write_register(par, NUMARGS(__VA_ARGS__), __VA_ARGS__))
>
> What is the maximum parameters .write_register() takes in practice in the
> fbtft drivers? If it's less than or equal to 15, we may use args.h instead.
>
> --
> With Best Regards,
> Andy Shevchenko
>
>
--
Regards,
Joyeta Modak
^ permalink raw reply
* Re: [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used
From: David Laight @ 2026-06-26 6:48 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625103041.281190-1-suryasaimadhu369@gmail.com>
On Thu, 25 Jun 2026 18:30:41 +0800
suryasaimadhu <suryasaimadhu369@gmail.com> wrote:
> When par->startbyte is non-zero, buf is advanced by one byte creating
> an unaligned pointer for 16-bit types (u16, __be16). Dereferencing this
> unaligned pointer can cause a kernel panic on strict-alignment
> architectures.
>
> Fix by using put_unaligned() instead of direct pointer dereference.
>
> Also fix incorrect buffer size calculation in fbtft_write_buf_dc() call:
> len * (sizeof(data_type) + offset) /* wrong: multiplies offset by len */
> len * sizeof(data_type) + offset /* correct: one startbyte +
> len items */
That should probably be a separate patch.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> ---
> drivers/staging/fbtft/fbtft-bus.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
> index 2169f8d1d..cfcf4d7e7 100644
> --- a/drivers/staging/fbtft/fbtft-bus.c
> +++ b/drivers/staging/fbtft/fbtft-bus.c
> @@ -4,6 +4,7 @@
> #include <linux/gpio/consumer.h>
> #include <linux/spi/spi.h>
> #include "fbtft.h"
> +#include <linux/unaligned.h>
>
> /*****************************************************************************
> *
> @@ -40,7 +41,7 @@ void func(struct fbtft_par *par, int len, ...) \
I'd consider changing that to:
func(struct fbtft_par *par, int len, u8 cmd, ...)
and probably reducing len by one.
It makes it more obvious that the first parameter is mandatory and the ... is
associated data.
David
> offset = 1; \
> } \
> \
> - *buf = modifier((data_type)va_arg(args, unsigned int)); \
> + put_unaligned(modifier((data_type)va_arg(args, unsigned int)), buf); \
> ret = fbtft_write_buf_dc(par, par->buf, sizeof(data_type) + offset, \
> 0); \
> if (ret < 0) \
> @@ -52,11 +53,13 @@ void func(struct fbtft_par *par, int len, ...) \
> \
> if (len) { \
> i = len; \
> - while (i--) \
> - *buf++ = modifier((data_type)va_arg(args, \
> - unsigned int)); \
> + while (i--) { \
> + put_unaligned(modifier((data_type)va_arg(args, \
> + unsigned int)), buf); \
> + buf++; \
> + } \
> fbtft_write_buf_dc(par, par->buf, \
> - len * (sizeof(data_type) + offset), 1); \
> + len * sizeof(data_type) + offset, 1); \
> } \
> out: \
> va_end(args); \
^ permalink raw reply
* [PATCH v2] fbdev: fix use-after-free in store_modes()
From: Ian Bridges @ 2026-06-26 4:50 UTC (permalink / raw)
To: Simona Vetter, Helge Deller, linux-fbdev, dri-devel, linux-kernel
store_modes() replaces a framebuffer's modelist with modes from userspace.
On success it frees the old modelist with fb_destroy_modelist(). Two
fields still point into that freed list.
One pointer is fb_display[i].mode, the mode a console is using.
fbcon_new_modelist() moves these pointers to the new list. It only does so
for consoles still mapped to the framebuffer. An unmapped console is
skipped and keeps its stale pointer. Unbinding fbcon, for example, sets
con2fb_map[i] to -1 but leaves fb_display[i].mode set. An
FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE later reaches
fbcon_mode_deleted(). That function reads the stale fb_display[i].mode
through fb_mode_is_equal(). The read is a use-after-free.
The other pointer is fb_info->mode, the current mode. It is set through
the mode sysfs attribute. store_modes() does not update fb_info->mode, so
it is left pointing into the freed list. show_mode(), the attribute's read
handler, dereferences the stale fb_info->mode through mode_string(). The
read is a use-after-free.
Clear both pointers before freeing the list. Commit a1f305893074 ("fbcon:
Set fb_display[i]->mode to NULL when the mode is released") added the
helper fbcon_delete_modelist(). It clears every fb_display[i].mode that
points into a given list. So far it is called only from the unregister
path. Call it from store_modes() too, and set fb_info->mode to NULL.
Reported-by: syzbot+81c7c6b52649fd07299d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=81c7c6b52649fd07299d
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/ajjoDhAi2y4ArSlz@dev/
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges <icb@fastmail.org>
---
Added in v2: clear fb_info->mode, which is left dangling by the same free
in store_modes(). Sashiko flagged that second pointer while reviewing
v1 [1].
[1] https://lore.kernel.org/all/20260622080749.D7FC61F000E9@smtp.kernel.org/
drivers/video/fbdev/core/fbsysfs.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c
index d9743ef35355..ea196603c7a8 100644
--- a/drivers/video/fbdev/core/fbsysfs.c
+++ b/drivers/video/fbdev/core/fbsysfs.c
@@ -10,6 +10,7 @@
#include <linux/major.h>
#include "fb_internal.h"
+#include "fbcon.h"
static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var)
{
@@ -108,8 +109,15 @@ static ssize_t store_modes(struct device *device,
if (fb_new_modelist(fb_info)) {
fb_destroy_modelist(&fb_info->modelist);
list_splice(&old_list, &fb_info->modelist);
- } else
+ } else {
+ /*
+ * fb_display[i].mode and fb_info->mode both point into the old
+ * list. Clear them before it is freed.
+ */
+ fbcon_delete_modelist(&old_list);
+ fb_info->mode = NULL;
fb_destroy_modelist(&old_list);
+ }
unlock_fb_info(fb_info);
console_unlock();
--
2.47.3
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: fix const pointer declaration
From: kernel test robot @ 2026-06-26 0:22 UTC (permalink / raw)
To: suryasaimadhu, sudipm.mukherjee, teddy.wang
Cc: oe-kbuild-all, gregkh, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
In-Reply-To: <20260625071348.132880-1-suryasaimadhu369@gmail.com>
Hi suryasaimadhu,
kernel test robot noticed the following build errors:
[auto build test ERROR on staging/staging-testing]
url: https://github.com/intel-lab-lkp/linux/commits/suryasaimadhu/staging-sm750fb-fix-const-pointer-declaration/20260625-151537
base: staging/staging-testing
patch link: https://lore.kernel.org/r/20260625071348.132880-1-suryasaimadhu369%40gmail.com
patch subject: [PATCH] staging: sm750fb: fix const pointer declaration
config: i386-buildonly-randconfig-001-20260626 (https://download.01.org/0day-ci/archive/20260626/202606260825.72C9EkKG-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260626/202606260825.72C9EkKG-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606260825.72C9EkKG-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/staging/sm750fb/sm750.c: In function 'lynxfb_set_fbinfo':
>> drivers/staging/sm750fb/sm750.c:773:33: error: assignment of read-only location 'g_fbmode[index]'
773 | g_fbmode[index] = g_def_fbmode;
| ^
drivers/staging/sm750fb/sm750.c:775:41: error: assignment of read-only location 'g_fbmode[index]'
775 | g_fbmode[index] = g_fbmode[0];
| ^
drivers/staging/sm750fb/sm750.c: In function 'sm750fb_setup':
>> drivers/staging/sm750fb/sm750.c:884:45: error: assignment of read-only location 'g_fbmode[0]'
884 | g_fbmode[0] = opt;
| ^
drivers/staging/sm750fb/sm750.c:888:45: error: assignment of read-only location 'g_fbmode[1]'
888 | g_fbmode[1] = opt;
| ^
vim +773 drivers/staging/sm750fb/sm750.c
81dee67e215b23 Sudip Mukherjee 2015-03-03 707
81dee67e215b23 Sudip Mukherjee 2015-03-03 708 static int lynxfb_set_fbinfo(struct fb_info *info, int index)
81dee67e215b23 Sudip Mukherjee 2015-03-03 709 {
81dee67e215b23 Sudip Mukherjee 2015-03-03 710 int i;
81dee67e215b23 Sudip Mukherjee 2015-03-03 711 struct lynxfb_par *par;
e359b6a863e19f Mike Rapoport 2015-10-26 712 struct sm750_dev *sm750_dev;
81dee67e215b23 Sudip Mukherjee 2015-03-03 713 struct lynxfb_crtc *crtc;
81dee67e215b23 Sudip Mukherjee 2015-03-03 714 struct lynxfb_output *output;
81dee67e215b23 Sudip Mukherjee 2015-03-03 715 struct fb_var_screeninfo *var;
81dee67e215b23 Sudip Mukherjee 2015-03-03 716 struct fb_fix_screeninfo *fix;
81dee67e215b23 Sudip Mukherjee 2015-03-03 717
81dee67e215b23 Sudip Mukherjee 2015-03-03 718 const struct fb_videomode *pdb[] = {
81dee67e215b23 Sudip Mukherjee 2015-03-03 719 lynx750_ext, NULL, vesa_modes,
81dee67e215b23 Sudip Mukherjee 2015-03-03 720 };
81dee67e215b23 Sudip Mukherjee 2015-03-03 721 int cdb[] = {ARRAY_SIZE(lynx750_ext), 0, VESA_MODEDB_SIZE};
d0856045f0e9fc Hungyu Lin 2026-04-01 722 static const char * const fix_id[2] = {
81dee67e215b23 Sudip Mukherjee 2015-03-03 723 "sm750_fb1", "sm750_fb2",
81dee67e215b23 Sudip Mukherjee 2015-03-03 724 };
81dee67e215b23 Sudip Mukherjee 2015-03-03 725
81dee67e215b23 Sudip Mukherjee 2015-03-03 726 int ret, line_length;
81dee67e215b23 Sudip Mukherjee 2015-03-03 727
81dee67e215b23 Sudip Mukherjee 2015-03-03 728 ret = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 729 par = (struct lynxfb_par *)info->par;
e359b6a863e19f Mike Rapoport 2015-10-26 730 sm750_dev = par->dev;
81dee67e215b23 Sudip Mukherjee 2015-03-03 731 crtc = &par->crtc;
81dee67e215b23 Sudip Mukherjee 2015-03-03 732 output = &par->output;
81dee67e215b23 Sudip Mukherjee 2015-03-03 733 var = &info->var;
81dee67e215b23 Sudip Mukherjee 2015-03-03 734 fix = &info->fix;
81dee67e215b23 Sudip Mukherjee 2015-03-03 735
81dee67e215b23 Sudip Mukherjee 2015-03-03 736 /* set index */
81dee67e215b23 Sudip Mukherjee 2015-03-03 737 par->index = index;
81dee67e215b23 Sudip Mukherjee 2015-03-03 738 output->channel = &crtc->channel;
81dee67e215b23 Sudip Mukherjee 2015-03-03 739 sm750fb_set_drv(par);
81dee67e215b23 Sudip Mukherjee 2015-03-03 740
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 741 /*
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 742 * set current cursor variable and proc pointer,
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 743 * must be set after crtc member initialized
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 744 */
fdc234d85210d9 Benjamin Philip 2021-07-28 745 crtc->cursor.offset = crtc->o_screen + crtc->vidmem_size - 1024;
e359b6a863e19f Mike Rapoport 2015-10-26 746 crtc->cursor.mmio = sm750_dev->pvReg +
e359b6a863e19f Mike Rapoport 2015-10-26 747 0x800f0 + (int)crtc->channel * 0x140;
81dee67e215b23 Sudip Mukherjee 2015-03-03 748
cd33da26036ea5 Christopher Carbone 2022-08-23 749 crtc->cursor.max_h = 64;
cd33da26036ea5 Christopher Carbone 2022-08-23 750 crtc->cursor.max_w = 64;
39f9137268ee3d Benjamin Philip 2021-07-26 751 crtc->cursor.size = crtc->cursor.max_h * crtc->cursor.max_w * 2 / 8;
f50b4602fea62f Jennifer Guo 2026-05-09 752 crtc->cursor.vstart = sm750_dev->vmem + crtc->cursor.offset;
81dee67e215b23 Sudip Mukherjee 2015-03-03 753
3de08a2d14ff8c Lorenzo Stoakes 2015-03-20 754 memset_io(crtc->cursor.vstart, 0, crtc->cursor.size);
f7c8a046577e09 Thomas Zimmermann 2023-11-27 755 if (!g_hwcursor)
52d0744d751d8f Arnd Bergmann 2016-11-09 756 sm750_hw_cursor_disable(&crtc->cursor);
81dee67e215b23 Sudip Mukherjee 2015-03-03 757
81dee67e215b23 Sudip Mukherjee 2015-03-03 758 /* set info->fbops, must be set before fb_find_mode */
e359b6a863e19f Mike Rapoport 2015-10-26 759 if (!sm750_dev->accel_off) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 760 /* use 2d acceleration */
f7c8a046577e09 Thomas Zimmermann 2023-11-27 761 if (!g_hwcursor)
f7c8a046577e09 Thomas Zimmermann 2023-11-27 762 info->fbops = &lynxfb_ops_accel;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 763 else
f7c8a046577e09 Thomas Zimmermann 2023-11-27 764 info->fbops = &lynxfb_ops_accel_with_cursor;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 765 } else {
f7c8a046577e09 Thomas Zimmermann 2023-11-27 766 if (!g_hwcursor)
81dee67e215b23 Sudip Mukherjee 2015-03-03 767 info->fbops = &lynxfb_ops;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 768 else
f7c8a046577e09 Thomas Zimmermann 2023-11-27 769 info->fbops = &lynxfb_ops_with_cursor;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 770 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 771
81dee67e215b23 Sudip Mukherjee 2015-03-03 772 if (!g_fbmode[index]) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 @773 g_fbmode[index] = g_def_fbmode;
81dee67e215b23 Sudip Mukherjee 2015-03-03 774 if (index)
81dee67e215b23 Sudip Mukherjee 2015-03-03 775 g_fbmode[index] = g_fbmode[0];
81dee67e215b23 Sudip Mukherjee 2015-03-03 776 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 777
81dee67e215b23 Sudip Mukherjee 2015-03-03 778 for (i = 0; i < 3; i++) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 779 ret = fb_find_mode(var, info, g_fbmode[index],
81dee67e215b23 Sudip Mukherjee 2015-03-03 780 pdb[i], cdb[i], NULL, 8);
81dee67e215b23 Sudip Mukherjee 2015-03-03 781
db7fb3588ab492 Artem Lytkin 2026-02-23 782 if (ret == 1 || ret == 2)
81dee67e215b23 Sudip Mukherjee 2015-03-03 783 break;
81dee67e215b23 Sudip Mukherjee 2015-03-03 784 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 785
81dee67e215b23 Sudip Mukherjee 2015-03-03 786 /* set par */
81dee67e215b23 Sudip Mukherjee 2015-03-03 787 par->info = info;
81dee67e215b23 Sudip Mukherjee 2015-03-03 788
81dee67e215b23 Sudip Mukherjee 2015-03-03 789 /* set info */
e3a3f9f5123683 Mike Rapoport 2015-10-26 790 line_length = ALIGN((var->xres_virtual * var->bits_per_pixel / 8),
e3a3f9f5123683 Mike Rapoport 2015-10-26 791 crtc->line_pad);
81dee67e215b23 Sudip Mukherjee 2015-03-03 792
81dee67e215b23 Sudip Mukherjee 2015-03-03 793 info->pseudo_palette = &par->pseudo_palette[0];
cc59bde1c920ab Benjamin Philip 2021-07-28 794 info->screen_base = crtc->v_screen;
81dee67e215b23 Sudip Mukherjee 2015-03-03 795 info->screen_size = line_length * var->yres_virtual;
81dee67e215b23 Sudip Mukherjee 2015-03-03 796
81dee67e215b23 Sudip Mukherjee 2015-03-03 797 /* set info->fix */
81dee67e215b23 Sudip Mukherjee 2015-03-03 798 fix->type = FB_TYPE_PACKED_PIXELS;
81dee67e215b23 Sudip Mukherjee 2015-03-03 799 fix->type_aux = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 800 fix->xpanstep = crtc->xpanstep;
81dee67e215b23 Sudip Mukherjee 2015-03-03 801 fix->ypanstep = crtc->ypanstep;
81dee67e215b23 Sudip Mukherjee 2015-03-03 802 fix->ywrapstep = crtc->ywrapstep;
81dee67e215b23 Sudip Mukherjee 2015-03-03 803 fix->accel = FB_ACCEL_SMI;
81dee67e215b23 Sudip Mukherjee 2015-03-03 804
8c475735085a7d Tim Wassink 2025-12-21 805 strscpy(fix->id, fix_id[index], sizeof(fix->id));
81dee67e215b23 Sudip Mukherjee 2015-03-03 806
fdc234d85210d9 Benjamin Philip 2021-07-28 807 fix->smem_start = crtc->o_screen + sm750_dev->vidmem_start;
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 808 /*
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 809 * according to mmap experiment from user space application,
81dee67e215b23 Sudip Mukherjee 2015-03-03 810 * fix->mmio_len should not larger than virtual size
81dee67e215b23 Sudip Mukherjee 2015-03-03 811 * (xres_virtual x yres_virtual x ByPP)
81dee67e215b23 Sudip Mukherjee 2015-03-03 812 * Below line maybe buggy when user mmap fb dev node and write
81dee67e215b23 Sudip Mukherjee 2015-03-03 813 * data into the bound over virtual size
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 814 */
81dee67e215b23 Sudip Mukherjee 2015-03-03 815 fix->smem_len = crtc->vidmem_size;
81dee67e215b23 Sudip Mukherjee 2015-03-03 816 info->screen_size = fix->smem_len;
81dee67e215b23 Sudip Mukherjee 2015-03-03 817 fix->line_length = line_length;
e359b6a863e19f Mike Rapoport 2015-10-26 818 fix->mmio_start = sm750_dev->vidreg_start;
e359b6a863e19f Mike Rapoport 2015-10-26 819 fix->mmio_len = sm750_dev->vidreg_size;
b610e1193a917f Matej Dujava 2020-04-30 820
b610e1193a917f Matej Dujava 2020-04-30 821 lynxfb_set_visual_mode(info);
81dee67e215b23 Sudip Mukherjee 2015-03-03 822
81dee67e215b23 Sudip Mukherjee 2015-03-03 823 /* set var */
81dee67e215b23 Sudip Mukherjee 2015-03-03 824 var->activate = FB_ACTIVATE_NOW;
81dee67e215b23 Sudip Mukherjee 2015-03-03 825 var->accel_flags = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 826 var->vmode = FB_VMODE_NONINTERLACED;
81dee67e215b23 Sudip Mukherjee 2015-03-03 827
61c507cf652da1 Michel von Czettritz 2015-03-26 828 ret = fb_alloc_cmap(&info->cmap, 256, 0);
61c507cf652da1 Michel von Czettritz 2015-03-26 829 if (ret < 0) {
fbab250eb51d6d Artem Lytkin 2026-02-07 830 dev_err(info->device, "Could not allocate memory for cmap.\n");
81dee67e215b23 Sudip Mukherjee 2015-03-03 831 goto exit;
81dee67e215b23 Sudip Mukherjee 2015-03-03 832 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 833
81dee67e215b23 Sudip Mukherjee 2015-03-03 834 exit:
81dee67e215b23 Sudip Mukherjee 2015-03-03 835 lynxfb_ops_check_var(var, info);
81dee67e215b23 Sudip Mukherjee 2015-03-03 836 return ret;
81dee67e215b23 Sudip Mukherjee 2015-03-03 837 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 838
81dee67e215b23 Sudip Mukherjee 2015-03-03 839 /* chip specific g_option configuration routine */
700591a9adc8b1 Mike Rapoport 2015-10-26 840 static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
81dee67e215b23 Sudip Mukherjee 2015-03-03 841 {
81dee67e215b23 Sudip Mukherjee 2015-03-03 842 char *opt;
81dee67e215b23 Sudip Mukherjee 2015-03-03 843 int swap;
81dee67e215b23 Sudip Mukherjee 2015-03-03 844
81dee67e215b23 Sudip Mukherjee 2015-03-03 845 swap = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 846
cc34db609ff98c Madhumitha Sundar 2026-01-27 847 sm750_dev->init_parm.chip_clk = 0;
cc34db609ff98c Madhumitha Sundar 2026-01-27 848 sm750_dev->init_parm.mem_clk = 0;
cc34db609ff98c Madhumitha Sundar 2026-01-27 849 sm750_dev->init_parm.master_clk = 0;
45a337c12624fc Jennifer Guo 2026-05-09 850 sm750_dev->init_parm.power_mode = 0;
cc34db609ff98c Madhumitha Sundar 2026-01-27 851 sm750_dev->init_parm.setAllEngOff = 0;
45a337c12624fc Jennifer Guo 2026-05-09 852 sm750_dev->init_parm.reset_memory = 1;
81dee67e215b23 Sudip Mukherjee 2015-03-03 853
81dee67e215b23 Sudip Mukherjee 2015-03-03 854 /* defaultly turn g_hwcursor on for both view */
81dee67e215b23 Sudip Mukherjee 2015-03-03 855 g_hwcursor = 3;
81dee67e215b23 Sudip Mukherjee 2015-03-03 856
81dee67e215b23 Sudip Mukherjee 2015-03-03 857 if (!src || !*src) {
c56de0967a658c Elise Lennion 2016-10-31 858 dev_warn(&sm750_dev->pdev->dev, "no specific g_option.\n");
81dee67e215b23 Sudip Mukherjee 2015-03-03 859 goto NO_PARAM;
81dee67e215b23 Sudip Mukherjee 2015-03-03 860 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 861
0fa96e39279988 Sudip Mukherjee 2015-03-10 862 while ((opt = strsep(&src, ":")) != NULL && *opt != 0) {
c56de0967a658c Elise Lennion 2016-10-31 863 dev_info(&sm750_dev->pdev->dev, "opt=%s\n", opt);
c56de0967a658c Elise Lennion 2016-10-31 864 dev_info(&sm750_dev->pdev->dev, "src=%s\n", src);
81dee67e215b23 Sudip Mukherjee 2015-03-03 865
144634a6b42146 Katie Dunne 2017-02-19 866 if (!strncmp(opt, "swap", strlen("swap"))) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 867 swap = 1;
144634a6b42146 Katie Dunne 2017-02-19 868 } else if (!strncmp(opt, "nocrt", strlen("nocrt"))) {
1757d106a9ce8c Mike Rapoport 2015-10-26 869 sm750_dev->nocrt = 1;
144634a6b42146 Katie Dunne 2017-02-19 870 } else if (!strncmp(opt, "36bit", strlen("36bit"))) {
94c938a0c15863 Shubham Chakraborty 2026-04-07 871 sm750_dev->pnltype = SM750_DOUBLE_TFT;
144634a6b42146 Katie Dunne 2017-02-19 872 } else if (!strncmp(opt, "18bit", strlen("18bit"))) {
94c938a0c15863 Shubham Chakraborty 2026-04-07 873 sm750_dev->pnltype = SM750_DUAL_TFT;
144634a6b42146 Katie Dunne 2017-02-19 874 } else if (!strncmp(opt, "24bit", strlen("24bit"))) {
94c938a0c15863 Shubham Chakraborty 2026-04-07 875 sm750_dev->pnltype = SM750_24TFT;
144634a6b42146 Katie Dunne 2017-02-19 876 } else if (!strncmp(opt, "nohwc0", strlen("nohwc0"))) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 877 g_hwcursor &= ~0x1;
144634a6b42146 Katie Dunne 2017-02-19 878 } else if (!strncmp(opt, "nohwc1", strlen("nohwc1"))) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 879 g_hwcursor &= ~0x2;
144634a6b42146 Katie Dunne 2017-02-19 880 } else if (!strncmp(opt, "nohwc", strlen("nohwc"))) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 881 g_hwcursor = 0;
144634a6b42146 Katie Dunne 2017-02-19 882 } else {
81dee67e215b23 Sudip Mukherjee 2015-03-03 883 if (!g_fbmode[0]) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 @884 g_fbmode[0] = opt;
cee9ba1c30d051 Abdul Rauf 2017-01-08 885 dev_info(&sm750_dev->pdev->dev,
cee9ba1c30d051 Abdul Rauf 2017-01-08 886 "find fbmode0 : %s\n", g_fbmode[0]);
81dee67e215b23 Sudip Mukherjee 2015-03-03 887 } else if (!g_fbmode[1]) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 888 g_fbmode[1] = opt;
cee9ba1c30d051 Abdul Rauf 2017-01-08 889 dev_info(&sm750_dev->pdev->dev,
cee9ba1c30d051 Abdul Rauf 2017-01-08 890 "find fbmode1 : %s\n", g_fbmode[1]);
81dee67e215b23 Sudip Mukherjee 2015-03-03 891 } else {
c56de0967a658c Elise Lennion 2016-10-31 892 dev_warn(&sm750_dev->pdev->dev, "How many view you wann set?\n");
81dee67e215b23 Sudip Mukherjee 2015-03-03 893 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 894 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 895 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 896
81dee67e215b23 Sudip Mukherjee 2015-03-03 897 NO_PARAM:
e359b6a863e19f Mike Rapoport 2015-10-26 898 if (sm750_dev->revid != SM750LE_REVISION_ID) {
a3f92cc94c6126 Mike Rapoport 2016-01-17 899 if (sm750_dev->fb_count > 1) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 900 if (swap)
1757d106a9ce8c Mike Rapoport 2015-10-26 901 sm750_dev->dataflow = sm750_dual_swap;
81dee67e215b23 Sudip Mukherjee 2015-03-03 902 else
1757d106a9ce8c Mike Rapoport 2015-10-26 903 sm750_dev->dataflow = sm750_dual_normal;
81dee67e215b23 Sudip Mukherjee 2015-03-03 904 } else {
81dee67e215b23 Sudip Mukherjee 2015-03-03 905 if (swap)
1757d106a9ce8c Mike Rapoport 2015-10-26 906 sm750_dev->dataflow = sm750_simul_sec;
81dee67e215b23 Sudip Mukherjee 2015-03-03 907 else
1757d106a9ce8c Mike Rapoport 2015-10-26 908 sm750_dev->dataflow = sm750_simul_pri;
81dee67e215b23 Sudip Mukherjee 2015-03-03 909 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 910 } else {
81dee67e215b23 Sudip Mukherjee 2015-03-03 911 /* SM750LE only have one crt channel */
1757d106a9ce8c Mike Rapoport 2015-10-26 912 sm750_dev->dataflow = sm750_simul_sec;
81dee67e215b23 Sudip Mukherjee 2015-03-03 913 /* sm750le do not have complex attributes */
1757d106a9ce8c Mike Rapoport 2015-10-26 914 sm750_dev->nocrt = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 915 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 916 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 917
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] staging: sm750fb: make g_fbmode array const pointer const
From: kernel test robot @ 2026-06-25 21:51 UTC (permalink / raw)
To: Shravya, sudipm.mukherjee, teddy.wang, gregkh
Cc: llvm, oe-kbuild-all, linux-fbdev, linux-staging, linux-kernel,
Shravya
In-Reply-To: <20260624233907.67886-1-shravy112@gmail.com>
Hi Shravya,
kernel test robot noticed the following build errors:
[auto build test ERROR on staging/staging-testing]
url: https://github.com/intel-lab-lkp/linux/commits/Shravya/staging-sm750fb-make-g_fbmode-array-const-pointer-const/20260625-074236
base: staging/staging-testing
patch link: https://lore.kernel.org/r/20260624233907.67886-1-shravy112%40gmail.com
patch subject: [PATCH] staging: sm750fb: make g_fbmode array const pointer const
config: riscv-allyesconfig (https://download.01.org/0day-ci/archive/20260626/202606260516.p4J1BHu3-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 6cc609bb250b21b47fc7d394b4019101e9983597)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260626/202606260516.p4J1BHu3-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606260516.p4J1BHu3-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/staging/sm750fb/sm750.c:773:19: error: cannot assign to variable 'g_fbmode' with const-qualified type 'const char *const[2]'
773 | g_fbmode[index] = g_def_fbmode;
| ~~~~~~~~~~~~~~~ ^
drivers/staging/sm750fb/sm750.c:24:27: note: variable 'g_fbmode' declared const here
24 | static const char * const g_fbmode[] = {NULL, NULL};
| ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/staging/sm750fb/sm750.c:775:20: error: cannot assign to variable 'g_fbmode' with const-qualified type 'const char *const[2]'
775 | g_fbmode[index] = g_fbmode[0];
| ~~~~~~~~~~~~~~~ ^
drivers/staging/sm750fb/sm750.c:24:27: note: variable 'g_fbmode' declared const here
24 | static const char * const g_fbmode[] = {NULL, NULL};
| ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/staging/sm750fb/sm750.c:884:17: error: cannot assign to variable 'g_fbmode' with const-qualified type 'const char *const[2]'
884 | g_fbmode[0] = opt;
| ~~~~~~~~~~~ ^
drivers/staging/sm750fb/sm750.c:24:27: note: variable 'g_fbmode' declared const here
24 | static const char * const g_fbmode[] = {NULL, NULL};
| ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/staging/sm750fb/sm750.c:888:17: error: cannot assign to variable 'g_fbmode' with const-qualified type 'const char *const[2]'
888 | g_fbmode[1] = opt;
| ~~~~~~~~~~~ ^
drivers/staging/sm750fb/sm750.c:24:27: note: variable 'g_fbmode' declared const here
24 | static const char * const g_fbmode[] = {NULL, NULL};
| ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
4 errors generated.
vim +773 drivers/staging/sm750fb/sm750.c
81dee67e215b23 Sudip Mukherjee 2015-03-03 707
81dee67e215b23 Sudip Mukherjee 2015-03-03 708 static int lynxfb_set_fbinfo(struct fb_info *info, int index)
81dee67e215b23 Sudip Mukherjee 2015-03-03 709 {
81dee67e215b23 Sudip Mukherjee 2015-03-03 710 int i;
81dee67e215b23 Sudip Mukherjee 2015-03-03 711 struct lynxfb_par *par;
e359b6a863e19f Mike Rapoport 2015-10-26 712 struct sm750_dev *sm750_dev;
81dee67e215b23 Sudip Mukherjee 2015-03-03 713 struct lynxfb_crtc *crtc;
81dee67e215b23 Sudip Mukherjee 2015-03-03 714 struct lynxfb_output *output;
81dee67e215b23 Sudip Mukherjee 2015-03-03 715 struct fb_var_screeninfo *var;
81dee67e215b23 Sudip Mukherjee 2015-03-03 716 struct fb_fix_screeninfo *fix;
81dee67e215b23 Sudip Mukherjee 2015-03-03 717
81dee67e215b23 Sudip Mukherjee 2015-03-03 718 const struct fb_videomode *pdb[] = {
81dee67e215b23 Sudip Mukherjee 2015-03-03 719 lynx750_ext, NULL, vesa_modes,
81dee67e215b23 Sudip Mukherjee 2015-03-03 720 };
81dee67e215b23 Sudip Mukherjee 2015-03-03 721 int cdb[] = {ARRAY_SIZE(lynx750_ext), 0, VESA_MODEDB_SIZE};
d0856045f0e9fc Hungyu Lin 2026-04-01 722 static const char * const fix_id[2] = {
81dee67e215b23 Sudip Mukherjee 2015-03-03 723 "sm750_fb1", "sm750_fb2",
81dee67e215b23 Sudip Mukherjee 2015-03-03 724 };
81dee67e215b23 Sudip Mukherjee 2015-03-03 725
81dee67e215b23 Sudip Mukherjee 2015-03-03 726 int ret, line_length;
81dee67e215b23 Sudip Mukherjee 2015-03-03 727
81dee67e215b23 Sudip Mukherjee 2015-03-03 728 ret = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 729 par = (struct lynxfb_par *)info->par;
e359b6a863e19f Mike Rapoport 2015-10-26 730 sm750_dev = par->dev;
81dee67e215b23 Sudip Mukherjee 2015-03-03 731 crtc = &par->crtc;
81dee67e215b23 Sudip Mukherjee 2015-03-03 732 output = &par->output;
81dee67e215b23 Sudip Mukherjee 2015-03-03 733 var = &info->var;
81dee67e215b23 Sudip Mukherjee 2015-03-03 734 fix = &info->fix;
81dee67e215b23 Sudip Mukherjee 2015-03-03 735
81dee67e215b23 Sudip Mukherjee 2015-03-03 736 /* set index */
81dee67e215b23 Sudip Mukherjee 2015-03-03 737 par->index = index;
81dee67e215b23 Sudip Mukherjee 2015-03-03 738 output->channel = &crtc->channel;
81dee67e215b23 Sudip Mukherjee 2015-03-03 739 sm750fb_set_drv(par);
81dee67e215b23 Sudip Mukherjee 2015-03-03 740
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 741 /*
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 742 * set current cursor variable and proc pointer,
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 743 * must be set after crtc member initialized
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 744 */
fdc234d85210d9 Benjamin Philip 2021-07-28 745 crtc->cursor.offset = crtc->o_screen + crtc->vidmem_size - 1024;
e359b6a863e19f Mike Rapoport 2015-10-26 746 crtc->cursor.mmio = sm750_dev->pvReg +
e359b6a863e19f Mike Rapoport 2015-10-26 747 0x800f0 + (int)crtc->channel * 0x140;
81dee67e215b23 Sudip Mukherjee 2015-03-03 748
cd33da26036ea5 Christopher Carbone 2022-08-23 749 crtc->cursor.max_h = 64;
cd33da26036ea5 Christopher Carbone 2022-08-23 750 crtc->cursor.max_w = 64;
39f9137268ee3d Benjamin Philip 2021-07-26 751 crtc->cursor.size = crtc->cursor.max_h * crtc->cursor.max_w * 2 / 8;
f50b4602fea62f Jennifer Guo 2026-05-09 752 crtc->cursor.vstart = sm750_dev->vmem + crtc->cursor.offset;
81dee67e215b23 Sudip Mukherjee 2015-03-03 753
3de08a2d14ff8c Lorenzo Stoakes 2015-03-20 754 memset_io(crtc->cursor.vstart, 0, crtc->cursor.size);
f7c8a046577e09 Thomas Zimmermann 2023-11-27 755 if (!g_hwcursor)
52d0744d751d8f Arnd Bergmann 2016-11-09 756 sm750_hw_cursor_disable(&crtc->cursor);
81dee67e215b23 Sudip Mukherjee 2015-03-03 757
81dee67e215b23 Sudip Mukherjee 2015-03-03 758 /* set info->fbops, must be set before fb_find_mode */
e359b6a863e19f Mike Rapoport 2015-10-26 759 if (!sm750_dev->accel_off) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 760 /* use 2d acceleration */
f7c8a046577e09 Thomas Zimmermann 2023-11-27 761 if (!g_hwcursor)
f7c8a046577e09 Thomas Zimmermann 2023-11-27 762 info->fbops = &lynxfb_ops_accel;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 763 else
f7c8a046577e09 Thomas Zimmermann 2023-11-27 764 info->fbops = &lynxfb_ops_accel_with_cursor;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 765 } else {
f7c8a046577e09 Thomas Zimmermann 2023-11-27 766 if (!g_hwcursor)
81dee67e215b23 Sudip Mukherjee 2015-03-03 767 info->fbops = &lynxfb_ops;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 768 else
f7c8a046577e09 Thomas Zimmermann 2023-11-27 769 info->fbops = &lynxfb_ops_with_cursor;
f7c8a046577e09 Thomas Zimmermann 2023-11-27 770 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 771
81dee67e215b23 Sudip Mukherjee 2015-03-03 772 if (!g_fbmode[index]) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 @773 g_fbmode[index] = g_def_fbmode;
81dee67e215b23 Sudip Mukherjee 2015-03-03 774 if (index)
81dee67e215b23 Sudip Mukherjee 2015-03-03 775 g_fbmode[index] = g_fbmode[0];
81dee67e215b23 Sudip Mukherjee 2015-03-03 776 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 777
81dee67e215b23 Sudip Mukherjee 2015-03-03 778 for (i = 0; i < 3; i++) {
81dee67e215b23 Sudip Mukherjee 2015-03-03 779 ret = fb_find_mode(var, info, g_fbmode[index],
81dee67e215b23 Sudip Mukherjee 2015-03-03 780 pdb[i], cdb[i], NULL, 8);
81dee67e215b23 Sudip Mukherjee 2015-03-03 781
db7fb3588ab492 Artem Lytkin 2026-02-23 782 if (ret == 1 || ret == 2)
81dee67e215b23 Sudip Mukherjee 2015-03-03 783 break;
81dee67e215b23 Sudip Mukherjee 2015-03-03 784 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 785
81dee67e215b23 Sudip Mukherjee 2015-03-03 786 /* set par */
81dee67e215b23 Sudip Mukherjee 2015-03-03 787 par->info = info;
81dee67e215b23 Sudip Mukherjee 2015-03-03 788
81dee67e215b23 Sudip Mukherjee 2015-03-03 789 /* set info */
e3a3f9f5123683 Mike Rapoport 2015-10-26 790 line_length = ALIGN((var->xres_virtual * var->bits_per_pixel / 8),
e3a3f9f5123683 Mike Rapoport 2015-10-26 791 crtc->line_pad);
81dee67e215b23 Sudip Mukherjee 2015-03-03 792
81dee67e215b23 Sudip Mukherjee 2015-03-03 793 info->pseudo_palette = &par->pseudo_palette[0];
cc59bde1c920ab Benjamin Philip 2021-07-28 794 info->screen_base = crtc->v_screen;
81dee67e215b23 Sudip Mukherjee 2015-03-03 795 info->screen_size = line_length * var->yres_virtual;
81dee67e215b23 Sudip Mukherjee 2015-03-03 796
81dee67e215b23 Sudip Mukherjee 2015-03-03 797 /* set info->fix */
81dee67e215b23 Sudip Mukherjee 2015-03-03 798 fix->type = FB_TYPE_PACKED_PIXELS;
81dee67e215b23 Sudip Mukherjee 2015-03-03 799 fix->type_aux = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 800 fix->xpanstep = crtc->xpanstep;
81dee67e215b23 Sudip Mukherjee 2015-03-03 801 fix->ypanstep = crtc->ypanstep;
81dee67e215b23 Sudip Mukherjee 2015-03-03 802 fix->ywrapstep = crtc->ywrapstep;
81dee67e215b23 Sudip Mukherjee 2015-03-03 803 fix->accel = FB_ACCEL_SMI;
81dee67e215b23 Sudip Mukherjee 2015-03-03 804
8c475735085a7d Tim Wassink 2025-12-21 805 strscpy(fix->id, fix_id[index], sizeof(fix->id));
81dee67e215b23 Sudip Mukherjee 2015-03-03 806
fdc234d85210d9 Benjamin Philip 2021-07-28 807 fix->smem_start = crtc->o_screen + sm750_dev->vidmem_start;
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 808 /*
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 809 * according to mmap experiment from user space application,
81dee67e215b23 Sudip Mukherjee 2015-03-03 810 * fix->mmio_len should not larger than virtual size
81dee67e215b23 Sudip Mukherjee 2015-03-03 811 * (xres_virtual x yres_virtual x ByPP)
81dee67e215b23 Sudip Mukherjee 2015-03-03 812 * Below line maybe buggy when user mmap fb dev node and write
81dee67e215b23 Sudip Mukherjee 2015-03-03 813 * data into the bound over virtual size
d11ac7cbcc266c Sudip Mukherjee 2015-08-07 814 */
81dee67e215b23 Sudip Mukherjee 2015-03-03 815 fix->smem_len = crtc->vidmem_size;
81dee67e215b23 Sudip Mukherjee 2015-03-03 816 info->screen_size = fix->smem_len;
81dee67e215b23 Sudip Mukherjee 2015-03-03 817 fix->line_length = line_length;
e359b6a863e19f Mike Rapoport 2015-10-26 818 fix->mmio_start = sm750_dev->vidreg_start;
e359b6a863e19f Mike Rapoport 2015-10-26 819 fix->mmio_len = sm750_dev->vidreg_size;
b610e1193a917f Matej Dujava 2020-04-30 820
b610e1193a917f Matej Dujava 2020-04-30 821 lynxfb_set_visual_mode(info);
81dee67e215b23 Sudip Mukherjee 2015-03-03 822
81dee67e215b23 Sudip Mukherjee 2015-03-03 823 /* set var */
81dee67e215b23 Sudip Mukherjee 2015-03-03 824 var->activate = FB_ACTIVATE_NOW;
81dee67e215b23 Sudip Mukherjee 2015-03-03 825 var->accel_flags = 0;
81dee67e215b23 Sudip Mukherjee 2015-03-03 826 var->vmode = FB_VMODE_NONINTERLACED;
81dee67e215b23 Sudip Mukherjee 2015-03-03 827
61c507cf652da1 Michel von Czettritz 2015-03-26 828 ret = fb_alloc_cmap(&info->cmap, 256, 0);
61c507cf652da1 Michel von Czettritz 2015-03-26 829 if (ret < 0) {
fbab250eb51d6d Artem Lytkin 2026-02-07 830 dev_err(info->device, "Could not allocate memory for cmap.\n");
81dee67e215b23 Sudip Mukherjee 2015-03-03 831 goto exit;
81dee67e215b23 Sudip Mukherjee 2015-03-03 832 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 833
81dee67e215b23 Sudip Mukherjee 2015-03-03 834 exit:
81dee67e215b23 Sudip Mukherjee 2015-03-03 835 lynxfb_ops_check_var(var, info);
81dee67e215b23 Sudip Mukherjee 2015-03-03 836 return ret;
81dee67e215b23 Sudip Mukherjee 2015-03-03 837 }
81dee67e215b23 Sudip Mukherjee 2015-03-03 838
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] fbdev: via: return an error when DMA copy times out
From: Helge Deller @ 2026-06-25 16:36 UTC (permalink / raw)
To: Pengpeng Hou, Florian Tobias Schandinat
Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <20260624144313.79291-1-pengpeng@iscas.ac.cn>
On 6/24/26 16:43, Pengpeng Hou wrote:
> viafb_dma_copy_out_sg() logs a VIA DMA timeout when the DONE bit is not
> set after the completion wait and grace delay, but still returns success
> to the caller.
>
> Preserve the existing cleanup sequence and return -ETIMEDOUT when the DMA
> engine did not report completion.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/video/fbdev/via/via-core.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
Note that the return value isn't checked by the caller.
Nevertheless, it's a cleanup, so I applied it.
Thanks!
Helge
^ permalink raw reply
* Re: [PATCH] fbdev: goldfishfb: fail pan display on base-update timeout
From: Helge Deller @ 2026-06-25 16:29 UTC (permalink / raw)
To: Pengpeng Hou; +Cc: linux-fbdev, dri-devel, linux-kernel
In-Reply-To: <20260625030102.79755-1-pengpeng@iscas.ac.cn>
On 6/25/26 05:01, Pengpeng Hou wrote:
> goldfish_fb_pan_display() waits for the device to acknowledge the new
> framebuffer base, but it only logs a timeout and still reports success.
> The probe path also ignores the initial pan-display result before
> registering the framebuffer.
>
> Return -ETIMEDOUT when the base-update acknowledgment does not arrive,
> and propagate that error from the initial probe-time base update before
> the framebuffer is published.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/video/fbdev/goldfishfb.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
applied.
Thanks!
Helge
^ permalink raw reply
* Re: [PATCH v2] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
From: Helge Deller @ 2026-06-25 16:18 UTC (permalink / raw)
To: Mingyu Wang, tzimmermann, simona
Cc: syoshida, dri-devel, linux-fbdev, linux-kernel, w15303746062,
stable
In-Reply-To: <20260625160306.438847-1-25181214217@stu.xidian.edu.cn>
On 6/25/26 18:03, Mingyu Wang wrote:
> When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
> inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
> label to roll back the console state. However, the current rollback logic
> forgets to restore the `hi_font` state, leading to a severe state machine
> corruption.
>
> Earlier in the function, `set_vc_hi_font()` might be called to change
> `vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
> subsequently fails, the `err_out` path restores `vc_font.charcount`
> but entirely skips rolling back the `vc_hi_font_mask` and the screen
> buffer.
>
> This mismatch leaves the terminal in a desynchronized state. Because
> `vc_hi_font_mask` remains set, the VT subsystem will still accept
> character indices greater than 255 from userspace and write them to the
> screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
> then use these inflated indices to access the reverted, 256-character
> font array, leading to a deterministic out-of-bounds read and potential
> kernel memory disclosure.
>
> Fix this by adding the missing rollback logic for the `hi_font` mask
> and screen buffer in the error path.
>
> Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
applied.
Thanks!
Helge
^ permalink raw reply
* [PATCH v2] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
From: Mingyu Wang @ 2026-06-25 16:03 UTC (permalink / raw)
To: deller, tzimmermann, simona
Cc: syoshida, dri-devel, linux-fbdev, linux-kernel, w15303746062,
Mingyu Wang, stable
When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.
Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.
This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.
Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path.
Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
Cc: stable@vger.kernel.org
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/video/fbdev/core/fbcon.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 9077d3b99357..37beb93045af 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2405,6 +2405,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
int resize, ret, old_width, old_height, old_charcount;
font_data_t *old_fontdata = p->fontdata;
const u8 *old_data = vc->vc_font.data;
+ unsigned short old_hi_font_mask = vc->vc_hi_font_mask;
font_data_get(data);
@@ -2451,6 +2452,12 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
vc->vc_font.height = old_height;
vc->vc_font.charcount = old_charcount;
+ /* Restore the hi_font state and screen buffer */
+ if (old_hi_font_mask && !vc->vc_hi_font_mask)
+ set_vc_hi_font(vc, true);
+ else if (!old_hi_font_mask && vc->vc_hi_font_mask)
+ set_vc_hi_font(vc, false);
+
font_data_put(data);
return ret;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
From: Mingyu Wang @ 2026-06-25 15:18 UTC (permalink / raw)
To: Thomas Zimmermann, w15303746062, deller, simona
Cc: syoshida, dri-devel, linux-fbdev, linux-kernel, stable
In-Reply-To: <7dd87e55-5170-4317-8c9e-38a7868f68fc@suse.de>
Hi Thomas,
>
> The email in your S-o-b tag differs from the one in the mail's From:
> line. I think this is not accepted in the kernel. Can you please
> resubmit with the email addresses synchronized.
>
>
Thank you very much for the review and the Reviewed-by tag!
The email mismatch was due to my university's SMTP server restrictions,
which forced me to use my personal 163 email to route the patch. I
apologize for the confusion.
I will synchronize my git authorship and Signed-off-by tags, and send a
v2 patch shortly with your Reviewed-by tag included.
Best regards,
Mingyu
^ permalink raw reply
* Re: [PATCH] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
From: Thomas Zimmermann @ 2026-06-25 15:04 UTC (permalink / raw)
To: w15303746062, deller, simona
Cc: syoshida, dri-devel, linux-fbdev, linux-kernel, Mingyu Wang,
stable
In-Reply-To: <20260624083316.389677-1-w15303746062@163.com>
Hi
Am 24.06.26 um 10:33 schrieb w15303746062@163.com:
> From: Mingyu Wang <25181214217@stu.xidian.edu.cn>
>
> When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
> inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
> label to roll back the console state. However, the current rollback logic
> forgets to restore the `hi_font` state, leading to a severe state machine
> corruption.
>
> Earlier in the function, `set_vc_hi_font()` might be called to change
> `vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
> subsequently fails, the `err_out` path restores `vc_font.charcount`
> but entirely skips rolling back the `vc_hi_font_mask` and the screen
> buffer.
>
> This mismatch leaves the terminal in a desynchronized state. Because
> `vc_hi_font_mask` remains set, the VT subsystem will still accept
> character indices greater than 255 from userspace and write them to the
> screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
> then use these inflated indices to access the reverted, 256-character
> font array, leading to a deterministic out-of-bounds read and potential
> kernel memory disclosure.
>
> Fix this by adding the missing rollback logic for the `hi_font` mask
> and screen buffer in the error path.
>
> Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
The email in your S-o-b tag differs from the one in the mail's From:
line. I think this is not accepted in the kernel. Can you please
resubmit with the email addresses synchronized.
Apart from that:
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Thanks for fixing this problem.
Best regards
Thomas
> ---
> drivers/video/fbdev/core/fbcon.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index 9077d3b99357..5880ab9f3cde 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -2405,6 +2405,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
> int resize, ret, old_width, old_height, old_charcount;
> font_data_t *old_fontdata = p->fontdata;
> const u8 *old_data = vc->vc_font.data;
> + int old_hi_font_mask = vc->vc_hi_font_mask;
>
> font_data_get(data);
>
> @@ -2451,6 +2452,12 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
> vc->vc_font.height = old_height;
> vc->vc_font.charcount = old_charcount;
>
> + /* Restore the hi_font state and screen buffer */
> + if (old_hi_font_mask && !vc->vc_hi_font_mask)
> + set_vc_hi_font(vc, true);
> + else if (!old_hi_font_mask && vc->vc_hi_font_mask)
> + set_vc_hi_font(vc, false);
> +
> font_data_put(data);
>
> return ret;
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
^ permalink raw reply
* Re: [PATCH] staging: fbtft: replace empty modifier argument with no-op macro
From: Andy Shevchenko @ 2026-06-25 14:09 UTC (permalink / raw)
To: Sai Madhu
Cc: Dan Carpenter, andy, gregkh, dri-devel, linux-fbdev,
linux-staging, linux-kernel
In-Reply-To: <CAB0uMAeMOV4Xhq2cNVjxne89yqF8vdubM8-OpPYGK4f4yBLMNw@mail.gmail.com>
On Thu, Jun 25, 2026 at 04:00:24PM +0530, Sai Madhu wrote:
First of all, do not top-post!
> Thank you for the feedback. I understand and will drop this patch.
>
> I have also noticed two pre-existing bugs in the same file
> (unaligned access and buffer size calculation when startbyte is used)
> and have sent a separate patch to fix those.
> On Thu, 25 Jun 2026 at 15:58, Dan Carpenter <error27@gmail.com> wrote:
> > On Thu, Jun 25, 2026 at 05:27:21PM +0800, suryasaimadhu wrote:
> > I don't hate this patch, but I think we've decided to leave this
> > as-is.
Yep. as Dan said,
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used
From: Andy Shevchenko @ 2026-06-25 14:08 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625103041.281190-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 06:30:41PM +0800, suryasaimadhu wrote:
> When par->startbyte is non-zero, buf is advanced by one byte creating
> an unaligned pointer for 16-bit types (u16, __be16). Dereferencing this
> unaligned pointer can cause a kernel panic on strict-alignment
> architectures.
>
> Fix by using put_unaligned() instead of direct pointer dereference.
>
> Also fix incorrect buffer size calculation in fbtft_write_buf_dc() call:
> len * (sizeof(data_type) + offset) /* wrong: multiplies offset by len */
> len * sizeof(data_type) + offset /* correct: one startbyte +
> len items */
Same comments as per your other patch contributions. Make it cleaner next time.
So it seem a v2 should be a mini-series with fixes for different
issues/drivers/et cetera.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH] staging: fbtft: fix unaligned access and txbuf safety issues
From: Andy Shevchenko @ 2026-06-25 14:05 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625114215.325973-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 07:42:15PM +0800, suryasaimadhu wrote:
> This patch addresses several pre-existing issues in the fbtft driver:
>
> 1. define_fbtft_write_reg(): when par->startbyte is set, buf is
> advanced by one byte creating a misaligned pointer for 16-bit types.
> Use put_unaligned() for register writes and fix the SPI transfer
> size from len * (sizeof(data_type) + offset) to
> len * sizeof(data_type) + offset.
>
> 2. fbtft_write_vmem16_bus8() and fb_ra8875 write_vmem16_bus8(): same
> unaligned 16-bit stores when txbuf is byte-offset for a start
> prefix. Use put_unaligned() for pixel data copies.
>
> 3. tx_array_size underflow: both vmem helpers subtract 2 from
> tx_array_size when a startbyte prefix is used. A small txbuflen
> device property causes unsigned underflow and out-of-bounds heap
> writes. Fall back to the non-buffered write path when the buffer
> is too small.
>
> 4. fb_ra8875 write_vmem16_bus8(): missing NULL check for
> par->txbuf.buf, which remains NULL on big-endian when txbuflen is
> 0 because the PAGE_SIZE fallback is little-endian only. Fall back
> to direct write when the buffer is missing.
>
> Also replace empty modifier arguments in define_fbtft_write_reg() with
> a no-op macro to fix checkpatch warnings.
This looks like v2 of the thing without changelog and addressing the comments
that have been given against v1. I'm not even going to review that.
Please, consolidate feedback, take your time to study process documentation
(Documentation/process/* in the Linux kernel source tree) and try again a bit
later.
(The fix and report are valuable in general, thanks for doing that.)
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
From: Andy Shevchenko @ 2026-06-25 13:59 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625110237.304435-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 07:02:37PM +0800, suryasaimadhu wrote:
> fbtft_write_vmem16_bus8() and fb_ra8875's write_vmem16_bus8() offset
> txbuf16 by one byte for a command/start prefix, then store 16-bit pixel
> data via txbuf16[i]. On strict-alignment architectures this can fault
> the same way as the write_reg path fixed in the previous patch.
.write_reg()
Can you provide a real world example of the failure?
> Use put_unaligned() for these stores.
Sounds like a fix without Fixes tag.
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
Use your name in accordance with your official documents.
...
> +++ b/drivers/staging/fbtft/fb_ra8875.c
> @@ -10,6 +10,7 @@
> #include <linux/delay.h>
>
You should move this blank line to be...
> #include <linux/gpio/consumer.h>
> +#include <linux/unaligned.h>
...here.
> #include "fbtft.h"
...
> #define DRVNAME "fb_ra8875"
Are other drivers also being affected?
...
> +++ b/drivers/staging/fbtft/fbtft-bus.c
Also needs linux/unaligned.h.
> + put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
From: kernel test robot @ 2026-06-25 13:53 UTC (permalink / raw)
To: suryasaimadhu, andy
Cc: llvm, oe-kbuild-all, gregkh, dri-devel, linux-fbdev,
linux-staging, linux-kernel, suryasaimadhu
In-Reply-To: <20260625110237.304435-1-suryasaimadhu369@gmail.com>
Hi suryasaimadhu,
kernel test robot noticed the following build errors:
[auto build test ERROR on staging/staging-testing]
url: https://github.com/intel-lab-lkp/linux/commits/suryasaimadhu/staging-fbtft-fix-unaligned-vmem-writes-when-txbuf-is-byte-offset/20260625-190423
base: staging/staging-testing
patch link: https://lore.kernel.org/r/20260625110237.304435-1-suryasaimadhu369%40gmail.com
patch subject: [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
config: hexagon-allmodconfig (https://download.01.org/0day-ci/archive/20260625/202606252144.F56jkpaD-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 6cc609bb250b21b47fc7d394b4019101e9983597)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260625/202606252144.F56jkpaD-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606252144.F56jkpaD-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/staging/fbtft/fbtft-bus.c:157:4: error: call to undeclared function 'put_unaligned'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
157 | put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
| ^
1 error generated.
vim +/put_unaligned +157 drivers/staging/fbtft/fbtft-bus.c
113
114 /*****************************************************************************
115 *
116 * int (*write_vmem)(struct fbtft_par *par);
117 *
118 *****************************************************************************/
119
120 /* 16 bit pixel over 8-bit databus */
121 int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
122 {
123 u16 *vmem16;
124 __be16 *txbuf16 = par->txbuf.buf;
125 size_t remain;
126 size_t to_copy;
127 size_t tx_array_size;
128 int i;
129 int ret = 0;
130 size_t startbyte_size = 0;
131
132 remain = len / 2;
133 vmem16 = (u16 *)(par->info->screen_buffer + offset);
134
135 gpiod_set_value(par->gpio.dc, 1);
136
137 /* non buffered write */
138 if (!par->txbuf.buf)
139 return par->fbtftops.write(par, vmem16, len);
140
141 /* buffered write */
142 tx_array_size = par->txbuf.len / 2;
143
144 if (par->startbyte) {
145 txbuf16 = par->txbuf.buf + 1;
146 tx_array_size -= 2;
147 *(u8 *)(par->txbuf.buf) = par->startbyte | 0x2;
148 startbyte_size = 1;
149 }
150
151 while (remain) {
152 to_copy = min(tx_array_size, remain);
153 dev_dbg(par->info->device, "to_copy=%zu, remain=%zu\n",
154 to_copy, remain - to_copy);
155
156 for (i = 0; i < to_copy; i++)
> 157 put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
158
159 vmem16 = vmem16 + to_copy;
160 ret = par->fbtftops.write(par, par->txbuf.buf,
161 startbyte_size + to_copy * 2);
162 if (ret < 0)
163 return ret;
164 remain -= to_copy;
165 }
166
167 return ret;
168 }
169 EXPORT_SYMBOL(fbtft_write_vmem16_bus8);
170
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
From: kernel test robot @ 2026-06-25 13:20 UTC (permalink / raw)
To: suryasaimadhu, andy
Cc: oe-kbuild-all, gregkh, dri-devel, linux-fbdev, linux-staging,
linux-kernel, suryasaimadhu
In-Reply-To: <20260625110237.304435-1-suryasaimadhu369@gmail.com>
Hi suryasaimadhu,
kernel test robot noticed the following build errors:
[auto build test ERROR on staging/staging-testing]
url: https://github.com/intel-lab-lkp/linux/commits/suryasaimadhu/staging-fbtft-fix-unaligned-vmem-writes-when-txbuf-is-byte-offset/20260625-190423
base: staging/staging-testing
patch link: https://lore.kernel.org/r/20260625110237.304435-1-suryasaimadhu369%40gmail.com
patch subject: [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
config: sh-allmodconfig (https://download.01.org/0day-ci/archive/20260625/202606252119.rClVa8On-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260625/202606252119.rClVa8On-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606252119.rClVa8On-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/staging/fbtft/fbtft-bus.c: In function 'fbtft_write_vmem16_bus8':
>> drivers/staging/fbtft/fbtft-bus.c:157:25: error: implicit declaration of function 'put_unaligned' [-Wimplicit-function-declaration]
157 | put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
| ^~~~~~~~~~~~~
vim +/put_unaligned +157 drivers/staging/fbtft/fbtft-bus.c
113
114 /*****************************************************************************
115 *
116 * int (*write_vmem)(struct fbtft_par *par);
117 *
118 *****************************************************************************/
119
120 /* 16 bit pixel over 8-bit databus */
121 int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
122 {
123 u16 *vmem16;
124 __be16 *txbuf16 = par->txbuf.buf;
125 size_t remain;
126 size_t to_copy;
127 size_t tx_array_size;
128 int i;
129 int ret = 0;
130 size_t startbyte_size = 0;
131
132 remain = len / 2;
133 vmem16 = (u16 *)(par->info->screen_buffer + offset);
134
135 gpiod_set_value(par->gpio.dc, 1);
136
137 /* non buffered write */
138 if (!par->txbuf.buf)
139 return par->fbtftops.write(par, vmem16, len);
140
141 /* buffered write */
142 tx_array_size = par->txbuf.len / 2;
143
144 if (par->startbyte) {
145 txbuf16 = par->txbuf.buf + 1;
146 tx_array_size -= 2;
147 *(u8 *)(par->txbuf.buf) = par->startbyte | 0x2;
148 startbyte_size = 1;
149 }
150
151 while (remain) {
152 to_copy = min(tx_array_size, remain);
153 dev_dbg(par->info->device, "to_copy=%zu, remain=%zu\n",
154 to_copy, remain - to_copy);
155
156 for (i = 0; i < to_copy; i++)
> 157 put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
158
159 vmem16 = vmem16 + to_copy;
160 ret = par->fbtftops.write(par, par->txbuf.buf,
161 startbyte_size + to_copy * 2);
162 if (ret < 0)
163 return ret;
164 remain -= to_copy;
165 }
166
167 return ret;
168 }
169 EXPORT_SYMBOL(fbtft_write_vmem16_bus8);
170
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] staging: fbtft: fix unaligned access and txbuf safety issues
From: Dan Carpenter @ 2026-06-25 12:00 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625114215.325973-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 07:42:15PM +0800, suryasaimadhu wrote:
> This patch addresses several pre-existing issues in the fbtft driver:
>
> 1. define_fbtft_write_reg(): when par->startbyte is set, buf is
> advanced by one byte creating a misaligned pointer for 16-bit types.
> Use put_unaligned() for register writes and fix the SPI transfer
> size from len * (sizeof(data_type) + offset) to
> len * sizeof(data_type) + offset.
>
> 2. fbtft_write_vmem16_bus8() and fb_ra8875 write_vmem16_bus8(): same
> unaligned 16-bit stores when txbuf is byte-offset for a start
> prefix. Use put_unaligned() for pixel data copies.
>
> 3. tx_array_size underflow: both vmem helpers subtract 2 from
> tx_array_size when a startbyte prefix is used. A small txbuflen
> device property causes unsigned underflow and out-of-bounds heap
> writes. Fall back to the non-buffered write path when the buffer
> is too small.
>
> 4. fb_ra8875 write_vmem16_bus8(): missing NULL check for
> par->txbuf.buf, which remains NULL on big-endian when txbuflen is
> 0 because the PAGE_SIZE fallback is little-endian only. Fall back
> to direct write when the buffer is missing.
>
> Also replace empty modifier arguments in define_fbtft_write_reg() with
> a no-op macro to fix checkpatch warnings.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
Is this how you would sign a legal document?
This patch does too many things at once. Split it up. Also please
a delay between sending us patches. Otherwise it's overwhelming to
deal with. Bunch them together in a patchset instead of sending them
one by one.
regards,
dan carpenter
^ permalink raw reply
* [PATCH] staging: fbtft: fix unaligned access and txbuf safety issues
From: suryasaimadhu @ 2026-06-25 11:42 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
In-Reply-To: <20260625111602.438761F000E9@smtp.kernel.org>
This patch addresses several pre-existing issues in the fbtft driver:
1. define_fbtft_write_reg(): when par->startbyte is set, buf is
advanced by one byte creating a misaligned pointer for 16-bit types.
Use put_unaligned() for register writes and fix the SPI transfer
size from len * (sizeof(data_type) + offset) to
len * sizeof(data_type) + offset.
2. fbtft_write_vmem16_bus8() and fb_ra8875 write_vmem16_bus8(): same
unaligned 16-bit stores when txbuf is byte-offset for a start
prefix. Use put_unaligned() for pixel data copies.
3. tx_array_size underflow: both vmem helpers subtract 2 from
tx_array_size when a startbyte prefix is used. A small txbuflen
device property causes unsigned underflow and out-of-bounds heap
writes. Fall back to the non-buffered write path when the buffer
is too small.
4. fb_ra8875 write_vmem16_bus8(): missing NULL check for
par->txbuf.buf, which remains NULL on big-endian when txbuflen is
0 because the PAGE_SIZE fallback is little-endian only. Fall back
to direct write when the buffer is missing.
Also replace empty modifier arguments in define_fbtft_write_reg() with
a no-op macro to fix checkpatch warnings.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fb_ra8875.c | 10 +++++++++-
drivers/staging/fbtft/fbtft-bus.c | 25 +++++++++++++++++--------
2 files changed, 26 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/fbtft/fb_ra8875.c b/drivers/staging/fbtft/fb_ra8875.c
index 0ab1de664..06f650aac 100644
--- a/drivers/staging/fbtft/fb_ra8875.c
+++ b/drivers/staging/fbtft/fb_ra8875.c
@@ -10,6 +10,7 @@
#include <linux/delay.h>
#include <linux/gpio/consumer.h>
+#include <linux/unaligned.h>
#include "fbtft.h"
#define DRVNAME "fb_ra8875"
@@ -250,7 +251,14 @@ static int write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
remain = len / 2;
vmem16 = (u16 *)(par->info->screen_buffer + offset);
+
+ if (!par->txbuf.buf)
+ return par->fbtftops.write(par, vmem16, len);
+
tx_array_size = par->txbuf.len / 2;
+ if (tx_array_size <= 2)
+ return par->fbtftops.write(par, vmem16, len);
+
txbuf16 = par->txbuf.buf + 1;
tx_array_size -= 2;
*(u8 *)(par->txbuf.buf) = 0x00;
@@ -262,7 +270,7 @@ static int write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index 30e436ff1..52a0c5c0c 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -4,6 +4,7 @@
#include <linux/gpio/consumer.h>
#include <linux/spi/spi.h>
#include "fbtft.h"
+#include <linux/unaligned.h>
/*****************************************************************************
*
@@ -11,6 +12,7 @@
*
*****************************************************************************/
+#define fbtft_write_reg_no_modifier(x) (x)
#define define_fbtft_write_reg(func, buffer_type, data_type, modifier) \
void func(struct fbtft_par *par, int len, ...) \
{ \
@@ -39,7 +41,7 @@ void func(struct fbtft_par *par, int len, ...) \
offset = 1; \
} \
\
- *buf = modifier((data_type)va_arg(args, unsigned int)); \
+ put_unaligned(modifier((data_type)va_arg(args, unsigned int)), buf); \
ret = fbtft_write_buf_dc(par, par->buf, sizeof(data_type) + offset, \
0); \
if (ret < 0) \
@@ -51,20 +53,22 @@ void func(struct fbtft_par *par, int len, ...) \
\
if (len) { \
i = len; \
- while (i--) \
- *buf++ = modifier((data_type)va_arg(args, \
- unsigned int)); \
+ while (i--) { \
+ put_unaligned(modifier((data_type)va_arg(args, \
+ unsigned int)), buf); \
+ buf++; \
+ } \
fbtft_write_buf_dc(par, par->buf, \
- len * (sizeof(data_type) + offset), 1); \
+ len * sizeof(data_type) + offset, 1); \
} \
out: \
va_end(args); \
} \
EXPORT_SYMBOL(func);
-define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, )
+define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, fbtft_write_reg_no_modifier)
define_fbtft_write_reg(fbtft_write_reg16_bus8, __be16, u16, cpu_to_be16)
-define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, )
+define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, fbtft_write_reg_no_modifier)
void fbtft_write_reg8_bus9(struct fbtft_par *par, int len, ...)
{
@@ -142,19 +146,24 @@ int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
tx_array_size = par->txbuf.len / 2;
if (par->startbyte) {
+ if (tx_array_size <= 2)
+ return par->fbtftops.write(par, vmem16, len);
txbuf16 = par->txbuf.buf + 1;
tx_array_size -= 2;
*(u8 *)(par->txbuf.buf) = par->startbyte | 0x2;
startbyte_size = 1;
}
+ if (!tx_array_size)
+ return par->fbtftops.write(par, vmem16, len);
+
while (remain) {
to_copy = min(tx_array_size, remain);
dev_dbg(par->info->device, "to_copy=%zu, remain=%zu\n",
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
--
2.47.3
^ permalink raw reply related
* [PATCH] staging: fbtft: fix unaligned vmem writes when txbuf is byte-offset
From: suryasaimadhu @ 2026-06-25 11:02 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
In-Reply-To: <20260625104220.21E5A1F00A3D@smtp.kernel.org>
fbtft_write_vmem16_bus8() and fb_ra8875's write_vmem16_bus8() offset
txbuf16 by one byte for a command/start prefix, then store 16-bit pixel
data via txbuf16[i]. On strict-alignment architectures this can fault
the same way as the write_reg path fixed in the previous patch.
Use put_unaligned() for these stores.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fb_ra8875.c | 3 ++-
drivers/staging/fbtft/fbtft-bus.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/fbtft/fb_ra8875.c b/drivers/staging/fbtft/fb_ra8875.c
index 0ab1de664..5b95b0095 100644
--- a/drivers/staging/fbtft/fb_ra8875.c
+++ b/drivers/staging/fbtft/fb_ra8875.c
@@ -10,6 +10,7 @@
#include <linux/delay.h>
#include <linux/gpio/consumer.h>
+#include <linux/unaligned.h>
#include "fbtft.h"
#define DRVNAME "fb_ra8875"
@@ -262,7 +263,7 @@ static int write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index cfcf4d7e7..fc3faab7d 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -158,7 +158,7 @@ int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
to_copy, remain - to_copy);
for (i = 0; i < to_copy; i++)
- txbuf16[i] = cpu_to_be16(vmem16[i]);
+ put_unaligned(cpu_to_be16(vmem16[i]), &txbuf16[i]);
vmem16 = vmem16 + to_copy;
ret = par->fbtftops.write(par, par->txbuf.buf,
--
2.47.3
^ permalink raw reply related
* [PATCH] staging: fbtft: fix unaligned access and buffer size when startbyte is used
From: suryasaimadhu @ 2026-06-25 10:30 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
When par->startbyte is non-zero, buf is advanced by one byte creating
an unaligned pointer for 16-bit types (u16, __be16). Dereferencing this
unaligned pointer can cause a kernel panic on strict-alignment
architectures.
Fix by using put_unaligned() instead of direct pointer dereference.
Also fix incorrect buffer size calculation in fbtft_write_buf_dc() call:
len * (sizeof(data_type) + offset) /* wrong: multiplies offset by len */
len * sizeof(data_type) + offset /* correct: one startbyte +
len items */
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fbtft-bus.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index 2169f8d1d..cfcf4d7e7 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -4,6 +4,7 @@
#include <linux/gpio/consumer.h>
#include <linux/spi/spi.h>
#include "fbtft.h"
+#include <linux/unaligned.h>
/*****************************************************************************
*
@@ -40,7 +41,7 @@ void func(struct fbtft_par *par, int len, ...) \
offset = 1; \
} \
\
- *buf = modifier((data_type)va_arg(args, unsigned int)); \
+ put_unaligned(modifier((data_type)va_arg(args, unsigned int)), buf); \
ret = fbtft_write_buf_dc(par, par->buf, sizeof(data_type) + offset, \
0); \
if (ret < 0) \
@@ -52,11 +53,13 @@ void func(struct fbtft_par *par, int len, ...) \
\
if (len) { \
i = len; \
- while (i--) \
- *buf++ = modifier((data_type)va_arg(args, \
- unsigned int)); \
+ while (i--) { \
+ put_unaligned(modifier((data_type)va_arg(args, \
+ unsigned int)), buf); \
+ buf++; \
+ } \
fbtft_write_buf_dc(par, par->buf, \
- len * (sizeof(data_type) + offset), 1); \
+ len * sizeof(data_type) + offset, 1); \
} \
out: \
va_end(args); \
--
2.47.3
^ permalink raw reply related
* Re: [PATCH] staging: fbtft: replace empty modifier argument with no-op macro
From: Sai Madhu @ 2026-06-25 10:30 UTC (permalink / raw)
To: Dan Carpenter
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <aj0Cv0Wzb3rieNqW@stanley.mountain>
Hi Dan,
Thank you for the feedback. I understand and will drop this patch.
I have also noticed two pre-existing bugs in the same file
(unaligned access and buffer size calculation when startbyte is used)
and have sent a separate patch to fix those.
Regards,
suryasaimadhu
On Thu, 25 Jun 2026 at 15:58, Dan Carpenter <error27@gmail.com> wrote:
>
> On Thu, Jun 25, 2026 at 05:27:21PM +0800, suryasaimadhu wrote:
> > Define fbtft_write_reg_no_modifier() as an identity function and
> > use it in place of empty modifier arguments in define_fbtft_write_reg()
> > calls to fix checkpatch errors.
> >
> > Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> > ---
>
> I don't hate this patch, but I think we've decided to leave this
> as-is.
>
> regards,
> dan carpenter
>
^ permalink raw reply
* Re: [PATCH] staging: fbtft: replace empty modifier argument with no-op macro
From: Dan Carpenter @ 2026-06-25 10:28 UTC (permalink / raw)
To: suryasaimadhu
Cc: andy, gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel
In-Reply-To: <20260625092721.238366-1-suryasaimadhu369@gmail.com>
On Thu, Jun 25, 2026 at 05:27:21PM +0800, suryasaimadhu wrote:
> Define fbtft_write_reg_no_modifier() as an identity function and
> use it in place of empty modifier arguments in define_fbtft_write_reg()
> calls to fix checkpatch errors.
>
> Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> ---
I don't hate this patch, but I think we've decided to leave this
as-is.
regards,
dan carpenter
^ permalink raw reply
* [PATCH] staging: fbtft: replace empty modifier argument with no-op macro
From: suryasaimadhu @ 2026-06-25 9:27 UTC (permalink / raw)
To: andy
Cc: gregkh, dri-devel, linux-fbdev, linux-staging, linux-kernel,
suryasaimadhu
Define fbtft_write_reg_no_modifier() as an identity function and
use it in place of empty modifier arguments in define_fbtft_write_reg()
calls to fix checkpatch errors.
Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
---
drivers/staging/fbtft/fbtft-bus.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index 30e436ff1..2169f8d1d 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -11,6 +11,7 @@
*
*****************************************************************************/
+#define fbtft_write_reg_no_modifier(x) (x)
#define define_fbtft_write_reg(func, buffer_type, data_type, modifier) \
void func(struct fbtft_par *par, int len, ...) \
{ \
@@ -62,9 +63,9 @@ out: \
} \
EXPORT_SYMBOL(func);
-define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, )
+define_fbtft_write_reg(fbtft_write_reg8_bus8, u8, u8, fbtft_write_reg_no_modifier)
define_fbtft_write_reg(fbtft_write_reg16_bus8, __be16, u16, cpu_to_be16)
-define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, )
+define_fbtft_write_reg(fbtft_write_reg16_bus16, u16, u16, fbtft_write_reg_no_modifier)
void fbtft_write_reg8_bus9(struct fbtft_par *par, int len, ...)
{
--
2.47.3
^ permalink raw reply related
* Re: [PATCH] staging: sm750fb: fix const pointer declaration
From: Sai Madhu @ 2026-06-25 9:03 UTC (permalink / raw)
To: ahmet
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <f5be5a78-a649-447c-8145-b32a530194c2@sezginduran.net>
Hi Ahmet,
Thank you for the review.
I compiled the patch with CONFIG_FB_SM750 enabled and it fails
with the following errors:
sm750.c:773: error: assignment of read-only location 'g_fbmode[index]'
sm750.c:775: error: assignment of read-only location 'g_fbmode[index]'
sm750.c:884: error: assignment of read-only location 'g_fbmode[0]'
sm750.c:888: error: assignment of read-only location 'g_fbmode[1]'
The array elements are assigned at runtime in lynxfb_set_fbinfo()
and sm750fb_setup(), so making them const is incorrect.
The checkpatch warning is a false positive in this case.
I will drop this patch.
Regards,
suryasaimadhu
On Thu, 25 Jun 2026 at 12:58, Ahmet Sezgin Duran <ahmet@sezginduran.net> wrote:
>
> On 6/25/26 10:13 AM, suryasaimadhu wrote:
> > Make g_fbmode a constant pointer array by adding const qualifier
> > after the asterisk, as recommended by checkpatch.
> >
> > Signed-off-by: suryasaimadhu <suryasaimadhu369@gmail.com>
> > ---
> > drivers/staging/sm750fb/sm750.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
> > index 89c811e08..8f533f3b1 100644
> > --- a/drivers/staging/sm750fb/sm750.c
> > +++ b/drivers/staging/sm750fb/sm750.c
> > @@ -21,7 +21,7 @@
> > static int g_hwcursor = 1;
> > static int g_noaccel __ro_after_init;
> > static int g_nomtrr __ro_after_init;
> > -static const char *g_fbmode[] = {NULL, NULL};
> > +static const char * const g_fbmode[] = {NULL, NULL};
> > static const char *g_def_fbmode = "1024x768-32@60";
> > static char *g_settings;
> > static int g_dualview __ro_after_init;
>
> Did you compile this patch while sm750fb module is enabled?
>
> Regards,
> Ahmet Sezgin Duran
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox