- 05 Aug, 2022 1 commit
-
-
Zheyu Ma authored
In the function vt8623fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 583.339036] BUG: unable to handle page fault for address: ffffc90005000000 [ 583.339049] #PF: supervisor write access in kernel mode [ 583.339052] #PF: error_code(0x0002) - not-present page [ 583.339074] RIP: 0010:memset_orig+0x33/0xb0 [ 583.339110] Call Trace: [ 583.339118] vt8623fb_set_par+0x11cd/0x21e0 [ 583.339146] fb_set_var+0x604/0xeb0 [ 583.339181] do_fb_ioctl+0x234/0x670 [ 583.339209] fb_ioctl+0xdd/0x130 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: 558b7bd8 ("vt8623fb: new framebuffer driver for VIA VT8623") Signed-off-by:
Zheyu Ma <zheyuma97@gmail.com> Signed-off-by:
Helge Deller <deller@gmx.de>
-
- 03 Aug, 2022 2 commits
-
-
Zheyu Ma authored
Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug. If the user provides an improper 'pixclock' value that makes the argumet of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a divide-by-zero bug in: drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX))); The following log can reveal it: divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline] RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline] RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Fix this by checking the argument of i740_calc_vclk() first. Signed-off-by: -
Zheyu Ma authored
Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug in: drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0. and then in: drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock); we'll get a division-by-zero. The following log can reveal it: divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline] RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Fix this by checking the argument of ark_set_pixclock() first. Fixes: 681e1473 ("arkfb: new framebuffer driver for ARK Logic cards") Signed-off-by:
-
- 29 Jul, 2022 1 commit
-
-
Yang Yingliang authored
If devm_ioremap_resource() fails, it never return NULL, replace NULL test with IS_ERR(). Fixes: b083c22d ("video: fbdev: imxfb: Convert request_mem_region + ioremap to devm_ioremap_resource") Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com> Signed-off-by:
-
- 26 Jul, 2022 6 commits
-
-
Rustam Subkhankulov authored
The second operand of a '&&' operator has no impact on expression result for cases 400 and 512 in SiS_GetModeID(). Judging by the logic and the names of the variables, in both cases a typo was made. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by:
Rustam Subkhankulov <subkhankulov@ispras.ru> Fixes: 1da177e4 ("Linux-2.6.12-rc2") Signed-off-by:
-
Uwe Kleine-König authored
This has several advantages: - No need for manual undo of the two functions in the error path and the remove function. - Drops error handling in .remove() Note that returning early in .remove() yields resource leaks that often result in access of freed memory or unmapped registers later. - Fixes a resource leak request_mem_region allocates memory for the returned pointer that was never freed. Signed-off-by:
Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by:
-
Uwe Kleine-König authored
No source file but the driver itself includes the header containing the platform data definition. The last user is gone since commit 8485adf1 ("ARM: imx: Remove imx device directory"). Move the remaining symbols directly into the driver and remove the then unused header file. Signed-off-by:
-
Uwe Kleine-König authored
The only file that includes <linux/platform_data/video-imxfb.h> is the imxfb driver. Drop all symbols that are unused there. Signed-off-by:
-
Uwe Kleine-König authored
No source file but the driver itself includes the header containing the platform data definition. The last user is gone since commit 8485adf1 ("ARM: imx: Remove imx device directory"). So we can safely drop platform data support. Signed-off-by:
-
Liang He authored
In clcdfb_of_init_display(), we should call of_node_put() for the references returned by of_graph_get_next_endpoint() and of_graph_get_remote_port_parent() which have increased the refcount. Besides, we should call of_node_put() both in fail path or when the references are not used anymore. Fixes: d10715be ("video: ARM CLCD: Add DT support") Signed-off-by:
Liang He <windhl@126.com> Signed-off-by:
-
- 18 Jul, 2022 15 commits
-
-
Helge Deller authored
There is no need to EXPORT the functions hwa742_update_window_async() and omapfb_update_window_async() since they are not used anywhere inside or outside the kernel tree. Signed-off-by: -
Geert Uytterhoeven authored
As of v2.1.0, falcon_decode_var() contains a quirk to fix a rounding error, as explained by Günther Kelleter on Fri, 30 Aug 1996: This diff removes the now obsolete Falcon video option "pwrsave", and fixes a rounding error that is triggered by the resolution switching X server (those who use the pixel clock value 39722 in their /etc/fb.modes should change it to 39721). However, this causes the modified video mode returned by falcon_decode_var() to not match the video mode returned by falcon_encode_var(). Fix this by dropping the quirk. Unfortunately /etc/fb.modes in fbset was never updated, so the "640x480-60" mode still contains the wrong pixclock. Hence this change may introduce a regression. Signed-off-by:Geert Uytterhoeven <geert@linux-m68k.org> Tested-by:
Michael Schmitz <schmitzmic@gmail.com> Signed-off-by:
-
Geert Uytterhoeven authored
Several definitions and variables are unused. Some variables are set but further unused. Remove them. Signed-off-by:
-
Geert Uytterhoeven authored
The pixclock values in the vga and vga70 modes are wrong, as they should use the 25.175 MHz clock instead of the 32 MHz clock. Swap the left and right margins to match f25.{right,left} (struct pixel_clock declares them in a different order), and update the hsync lengths to match what the driver programs by default. Correct the (wrong) floating-point vrefresh value for the vga mode. Signed-off-by: -
Geert Uytterhoeven authored
The vertical refresh rate for the TT High video mode (1280x960) is wrong. Fortunately this field is not really used. Signed-off-by:
-
Geert Uytterhoeven authored
Arbitrary pointers can be passed to functions accepting "void *" without casting. Remove the casts, as they make it impossible to validate types. Signed-off-by:
-
Geert Uytterhoeven authored
There is no need to cast fb_info.par to "struct atafb_par *", as the former has type "void *". Remove the casts, as they make it impossible to validate types. Signed-off-by:
-
Geert Uytterhoeven authored
The red, green, and blue color values are 16-bit, while the external graphics hardware registers are 8-bit. Add the missing conversion from 16-bit to 8-bit. Signed-off-by:
-
Geert Uytterhoeven authored
Currently, the "inverse" option does not do anything, as it just sets a flag, which is further unused. Fix this by calling fb_invert_cmaps() instead, like other drivers do. As this only affects the console colormap, this does not affect X. Update the documentation to match the actual behavior. Signed-off-by:
-
Geert Uytterhoeven authored
Vertical wrap is not supported (fb_fix_screeninfo.ywrapstep = 0), hence there is no point in setting the FB_VMODE_YWRAP flag in video modes. Signed-off-by:
-
Geert Uytterhoeven authored
The fb_pan_display() function in the core already takes care of validating the panning parameters before calling the driver's .fb_pan_display() callback, and of updating the panning state afterwards, so there is no need to repeat that in the driver. Remove the duplicate code. Signed-off-by:
-
Geert Uytterhoeven authored
The various *fb_setup() and *fb_init() functions are only used locally, so they should be static. Most of them do not need forward declarations, so remove these where appropriate. Signed-off-by:
-
Geert Uytterhoeven authored
cirrusfb_zorro_unregister() is only used locally, hence make it static. Signed-off-by:
-
Geert Uytterhoeven authored
sa1100fb_setup() has been unused since the beginning of Linux git history. Signed-off-by:
-
Geert Uytterhoeven authored
The fb_pan_display() function in the core already takes care of validating most panning parameters before calling the driver's .fb_pan_display() callback, and of updating the panning state afterwards, so there is no need to repeat that in the driver. Remove the duplicate code. Signed-off-by:
-
- 17 Jul, 2022 15 commits
-
-
Linus Torvalds authored
-
git://anongit.freedesktop.org/drm/drm-intelLinus Torvalds authored
Pull intel drm build fix from Rodrigo Vivi: "Our 'dim' flow has a problem with fixes of fixes getting missed. We need to take a look on that later. Meanwhile, please allow me to quickly propagate this fix for the 32-bit build issue here upstream" * tag 'drm-intel-fixes-2022-07-17' of git://anongit.freedesktop.org/drm/drm-intel: drm/i915/ttm: fix 32b build
-
Linus Torvalds authored
Merge tag 'perf-tools-fixes-for-v5.19-2022-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix SIGSEGV when processing syscall args in perf.data files in 'perf trace' - Sync kvm, msr-index and cpufeatures headers with the kernel sources - Fix 'convert perf time to TSC' 'perf test': - No need to open events twice - Fix finding correct event on hybrid systems * tag 'perf-tools-fixes-for-v5.19-2022-07-17' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf trace: Fix SIGSEGV when processing syscall args perf tests: Fix Convert perf time to TSC test for hybrid perf tests: Stop Convert perf time to TSC test opening events twice tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers cpufeatures: Sync with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources
-
Matthew Auld authored
Since segment_pages is no longer a compile time constant, it looks the DIV_ROUND_UP(node->size, segment_pages) breaks the 32b build. Simplest is just to use the ULL variant, but really we should need not need more than u32 for the page alignment (also we are limited by that due to the sg->length type), so also make it all u32. Reported-by:
Ville Syrjälä <ville.syrjala@linux.intel.com> Fixes: aff1e0b0 ("drm/i915/ttm: fix sg_table construction") Signed-off-by:
Matthew Auld <matthew.auld@intel.com> Cc: Nirmoy Das <nirmoy.das@linux.intel.com> Reviewed-by:
Nirmoy Das <nirmoy.das@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220712174050.592550-1-matthew.auld@intel.com (cherry picked from commit 9306b2b2) Signed-off-by:
Rodrigo Vivi <rodrigo.vivi@intel.com>
-
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tipLinus Torvalds authored
Pull perf fix from Borislav Petkov: - A single data race fix on the perf event cleanup path to avoid endless loops due to insufficient locking * tag 'perf_urgent_for_v5.19_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
-
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tipLinus Torvalds authored
Pull x86 fixes from Borislav Petkov: - Improve the check whether the kernel supports WP mappings so that it can accomodate a XenPV guest due to how the latter is setting up the PAT machinery - Now that the retbleed nightmare is public, here's the first round of fallout fixes: * Fix a build failure on 32-bit due to missing include * Remove an untraining point in espfix64 return path * other small cleanups * tag 'x86_urgent_for_v5.19_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Remove apostrophe typo um: Add missing apply_returns() x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt x86/bugs: Mark retbleed_strings static x86/pat: Fix x86_has_pat_wp() x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit -
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linuxLinus Torvalds authored
Pull gpio fix from Bartosz Golaszewski: - fix a configfs attribute of the gpio-sim module * tag 'gpio-fixes-for-v5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sim: fix the chip_name configfs item
-
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/inputLinus Torvalds authored
Pull input fixes from Dmitry Torokhov: - fix Goodix driver to properly behave on the Aya Neo Next - some more sanity checks in usbtouchscreen driver - a tweak in wm97xx driver in preparation for remove() to return void - a clarification in input core regarding units of measurement for resolution on touch events. * tag 'input-for-v5.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: document the units for resolution of size axes Input: goodix - call acpi_device_fix_up_power() in some cases Input: wm97xx - make .remove() obviously always return 0 Input: usbtouchscreen - add driver_info sanity check
-
git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supplyLinus Torvalds authored
Pull power supply fixes from Sebastian Reichel: - power-supply core temperature interpolation regression fix for incorrect boundaries - ab8500 needs to destroy its work queues in error paths - Fix old DT refcount leak in arm-versatile * tag 'for-v5.19-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: core: Fix boundary conditions in interpolation power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe power: supply: ab8500_fg: add missing destroy_workqueue in ab8500_fg_probe
-
Naveen N. Rao authored
On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to process a perf.data file created with 'perf trace record -p': #0 0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <snip> at builtin-trace.c:1492 #1 syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492 #2 syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486 #3 0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at builtin-trace.c:1973 #4 syscall__scnprintf_args <snip> at builtin-trace.c:2041 #5 0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2319 That points to the below code in tools/perf/builtin-trace.c: /* * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible * arguments, even if the syscall being handled, say "openat", uses only 4 arguments * this breaks syscall__augmented_args() check for augmented args, as we calculate * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file, * so when handling, say the openat syscall, we end up getting 6 args for the * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly * thinking that the extra 2 u64 args are the augmented filename, so just check * here and avoid using augmented syscalls when the evsel is the raw_syscalls one. */ if (evsel != trace->syscalls.events.sys_enter) augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); As the comment points out, we should not be trying to augment the args for raw_syscalls. However, when processing a perf.data file, we are not initializing those properly. Fix the same. Reported-by:
Claudio Carvalho <cclaudio@linux.ibm.com> Signed-off-by:
Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Link: http://lore.kernel.org/lkml/20220707090900.572584-1-naveen.n.rao@linux.vnet.ibm.comSigned-off-by:
Arnaldo Carvalho de Melo <acme@redhat.com>
-
Adrian Hunter authored
The test does not always correctly determine the number of events for hybrids, nor allow for more than 1 evsel when parsing. Fix by iterating the events actually created and getting the correct evsel for the events processed. Fixes: d9da6f70 ("perf tests: Support 'Convert perf time to TSC' test for hybrid") Reviewed-by:
Kan Liang <kan.liang@linux.intel.com> Signed-off-by:
Adrian Hunter <adrian.hunter@intel.com> Cc: Ian Rogers <irogers@google.com> Cc: Jin Yao <yao.jin@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Thomas Richter <tmricht@linux.ibm.com> Link: https://lore.kernel.org/r/20220713123459.24145-3-adrian.hunter@intel.comSigned-off-by:
-
Adrian Hunter authored
Do not call evlist__open() twice. Fixes: 5bb017d4 ("perf test: Fix error message for test case 71 on s390, where it is not supported") Reviewed-by:
-
Arnaldo Carvalho de Melo authored
To pick up the changes from these csets: 4ad3278d ("x86/speculation: Disable RRSBA behavior") d7caac99 ("x86/cpu/amd: Add Spectral Chicken") That cause no changes to tooling: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after $ Just silences this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Borislav Petkov <bp@suse.de> Cc: Ian Rogers <irogers@google.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/lkml/YtQTm9wsB3hxQWvy@kernel.orgSigned-off-by:
-
Arnaldo Carvalho de Melo authored
To pick the changes from: f43b9876 ("x86/retbleed: Add fine grained Kconfig knobs") a149180f ("x86: Add magic AMD return-thunk") 15e67227 ("x86: Undo return-thunk damage") 369ae6ff ("x86/retpoline: Cleanup some #ifdefery") 4ad3278d x86/speculation: Disable RRSBA behavior 26aae8cc x86/cpu/amd: Enumerate BTC_NO 9756bba2 x86/speculation: Fill RSB on vmexit for IBRS 3ebc1700 x86/bugs: Add retbleed=ibpb 2dbb887e x86/entry: Add kernel IBRS implementation 6b80b59b x86/bugs: Report AMD retbleed vulnerability a149180f x86: Add magic AMD return-thunk 15e67227 x86: Undo return-thunk damage a883d624 x86/cpufeatures: Move RETPOLINE flags to word 11 51802186 x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h' diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Borislav Petkov <bp@suse.de> Cc: Ian Rogers <irogers@google.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org Link: https://lore.kernel.org/lkml/YtQM40VmiLTkPND2@kernel.orgSigned-off-by:
-
Arnaldo Carvalho de Melo authored
To pick the changes in: 1b870fa5 ("kvm: stats: tell userspace which values are boolean") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the the 'perf trace' ioctl syscall argument beautifiers. This is also by now used by tools/testing/selftests/kvm/, a simple test build succeeded. This silences this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Ian Rogers <irogers@google.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Paolo Bonzini <pbonzini@redhat.com> Link: http://lore.kernel.org/lkml/YtQLDvQrBhJNl3n5@kernel.orgSigned-off-by:
-
