user/sven/linux.git/drivers/video/fbdev/s3fb.c, branch v5.4.249

video: fbdev: s3fb: Check the size of screen before memset_io()

2022-08-25T09:18:09Z

[ Upstream commit 6ba592fa014f21f35a8ee8da4ca7b95a018f13e8 ] In the function s3fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 54.083733] BUG: unable to handle page fault for address: ffffc90003000000 [ 54.083742] #PF: supervisor write access in kernel mode [ 54.083744] #PF: error_code(0x0002) - not-present page [ 54.083760] RIP: 0010:memset_orig+0x33/0xb0 [ 54.083782] Call Trace: [ 54.083788] s3fb_set_par+0x1ec6/0x4040 [ 54.083806] fb_set_var+0x604/0xeb0 [ 54.083836] do_fb_ioctl+0x234/0x670 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: a268422de8bf ("fbdev driver for S3 Trio/Virge") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

video: fbdev: don't print error message on framebuffer_alloc() failure

2019-06-28T10:30:08Z

framebuffer_alloc() can fail only on kzalloc() memory allocation failure and since kzalloc() will print error message in such case we can omit printing extra error message in drivers (which BTW is what the majority of framebuffer_alloc() users is doing already). Cc: "Bruno Prémont" Cc: Jiri Kosina Cc: Benjamin Tissoires Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: s3fb: constify pci_device_id.

2017-08-01T15:20:45Z

pci_device_id are not supposed to change at runtime. All functions working with pci_device_id provided by work with const pci_device_id. So mark the non-const structs as const. File size before: text data bss dec hex filename 20994 2440 8 23442 5b92 drivers/video/fbdev/s3fb.o File size after adding 'const': text data bss dec hex filename 21506 1928 8 23442 5b92 drivers/video/fbdev/s3fb.o Signed-off-by: Arvind Yadav Cc: Paul Mackerras Cc: Benjamin Herrenschmidt Cc: Antonino Daplas Cc: Maik Broemme Cc: Florian Tobias Schandinat Signed-off-by: Bartlomiej Zolnierkiewicz

drivers/video/fbdev/s3fb: Use arch_phys_wc_add() and pci_iomap_wc()

2015-08-25T07:59:45Z

This driver uses the same area for MTRR as for the ioremap(). Convert the driver from using the x86-specific MTRR code to the architecture-agnostic arch_phys_wc_add(). It will avoid MTRRs if write-combining is available. In order to take advantage of that also ensure the ioremapped area is requested as write-combining. There are a few motivations for this: a) Take advantage of PAT when available. b) Help bury MTRR code away, MTRR is architecture-specific and on x86 it is being replaced by PAT. c) Help with the goal of eventually using _PAGE_CACHE_UC over _PAGE_CACHE_UC_MINUS on x86 on ioremap_nocache() (see commit de33c442e titled "x86 PAT: fix performance drop for glx, use UC minus for ioremap(), ioremap_nocache() and pci_mmap_page_range()"). The conversion done is expressed by the following Coccinelle SmPL patch, it additionally required manual intervention to address all the ifdeffery and removal of redundant things which arch_phys_wc_add() already addresses such as verbose message about when MTRR fails and doing nothing when we didn't get an MTRR. @ mtrr_found @ expression index, base, size; @@ -index = mtrr_add(base, size, MTRR_TYPE_WRCOMB, 1); +index = arch_phys_wc_add(base, size); @ mtrr_rm depends on mtrr_found @ expression mtrr_found.index, mtrr_found.base, mtrr_found.size; @@ -mtrr_del(index, base, size); +arch_phys_wc_del(index); @ mtrr_rm_zero_arg depends on mtrr_found @ expression mtrr_found.index; @@ -mtrr_del(index, 0, 0); +arch_phys_wc_del(index); @ mtrr_rm_fb_info depends on mtrr_found @ struct fb_info *info; expression mtrr_found.index; @@ -mtrr_del(index, info->fix.smem_start, info->fix.smem_len); +arch_phys_wc_del(index); @ ioremap_replace_nocache depends on mtrr_found @ struct fb_info *info; expression base, size; @@ -info->screen_base = ioremap_nocache(base, size); +info->screen_base = ioremap_wc(base, size); @ ioremap_replace_default depends on mtrr_found @ struct fb_info *info; expression base, size; @@ -info->screen_base = ioremap(base, size); +info->screen_base = ioremap_wc(base, size); Signed-off-by: Luis R. Rodriguez Signed-off-by: Borislav Petkov Acked-by: Tomi Valkeinen Cc: Andrew Morton Cc: Andy Lutomirski Cc: Antonino Daplas Cc: Arnd Bergmann Cc: Daniel Vetter Cc: Dave Airlie Cc: Geert Uytterhoeven Cc: H. Peter Anvin Cc: Jean-Christophe Plagniol-Villard Cc: Jingoo Han Cc: Juergen Gross Cc: Lad, Prabhakar Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Rickard Strandqvist Cc: Suresh Siddha Cc: Thomas Gleixner Cc: airlied@linux.ie Cc: benh@kernel.crashing.org Cc: bhelgaas@google.com Cc: dan.j.williams@intel.com Cc: konrad.wilk@oracle.com Cc: linux-fbdev@vger.kernel.org Cc: linux-pci@vger.kernel.org Cc: mst@redhat.com Cc: toshi.kani@hp.com Cc: vinod.koul@intel.com Cc: xen-devel@lists.xensource.com Link: http://lkml.kernel.org/r/1440443613-13696-8-git-send-email-mcgrof@do-not-panic.com Signed-off-by: Ingo Molnar

video: fbdev: s3fb: suppress build warning

2014-12-04T13:41:18Z

this patch fixes following build warning: drivers/video/fbdev/s3fb.c: In function ‘s3_pci_probe’: drivers/video/fbdev/s3fb.c:1185:23: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] par->state.vgabase = (void __iomem *) vga_res.start; ^ Signed-off-by: Lad, Prabhakar Signed-off-by: Tomi Valkeinen

video: fbdev: s3fb.c: Fix for possible null pointer dereference

2014-05-23T10:47:31Z

There is otherwise a risk of a possible null pointer dereference. Was largely found by using a static code analysis program called cppcheck. Signed-off-by: Rickard Strandqvist Signed-off-by: Tomi Valkeinen

video: move fbdev to drivers/video/fbdev

2014-04-17T05:10:19Z

The drivers/video directory is a mess. It contains generic video related files, directories for backlight, console, linux logo, lots of fbdev device drivers, fbdev framework files. Make some order into the chaos by creating drivers/video/fbdev directory, and move all fbdev related files there. No functionality is changed, although I guess it is possible that some subtle Makefile build order related issue could be created by this patch. Signed-off-by: Tomi Valkeinen Acked-by: Laurent Pinchart Acked-by: Geert Uytterhoeven Acked-by: Rob Clark Acked-by: Jingoo Han Acked-by: Daniel Vetter