linux-toradex.git/drivers/video/fbdev/uvesafb.c, branch v5.9 Linux kernel for Apalis and Colibri modules video: fbdev: uvesafb: fix "noblank" option handling 2020-06-21T07:58:55+00:00 Bartlomiej Zolnierkiewicz b.zolnierkie@samsung.com 2020-06-09T09:29:43+00:00 7f757cb6b2fc0ad704d0ca0b7b5a2729aca35580 Fix the recent regression. Fixes: dbc7ece12a38 ("video: uvesafb: use true,false for bool variables") Cc: Jason Yan <yanaijie@huawei.com> Reviewed-by: Sam Ravnborg <sam@ravnborg.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Link: https://patchwork.freedesktop.org/patch/msgid/81c9f140-d6fb-803a-18c8-04dae1007ab3@samsung.com 
Fix the recent regression.

Fixes: dbc7ece12a38 ("video: uvesafb: use true,false for bool variables")
Cc: Jason Yan <yanaijie@huawei.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/81c9f140-d6fb-803a-18c8-04dae1007ab3@samsung.com
video: uvesafb: use true,false for bool variables 2020-05-06T17:32:08+00:00 Jason Yan yanaijie@huawei.com 2020-04-22T07:18:45+00:00 dbc7ece12a38889ceb3d7f99dad269822f6bd34e Fix the following coccicheck warning: drivers/video/fbdev/uvesafb.c:48:12-17: WARNING: Assignment of 0/1 to bool variable drivers/video/fbdev/uvesafb.c:1827:3-13: WARNING: Assignment of 0/1 to bool variable drivers/video/fbdev/uvesafb.c:1829:3-13: WARNING: Assignment of 0/1 to bool variable drivers/video/fbdev/uvesafb.c:1835:3-9: WARNING: Assignment of 0/1 to bool variable drivers/video/fbdev/uvesafb.c:1837:3-9: WARNING: Assignment of 0/1 to bool variable drivers/video/fbdev/uvesafb.c:1839:3-8: WARNING: Assignment of 0/1 to bool variable Signed-off-by: Jason Yan <yanaijie@huawei.com> Signed-off-by: Sam Ravnborg <sam@ravnborg.org> Link: https://patchwork.freedesktop.org/patch/msgid/20200422071845.403-1-yanaijie@huawei.com 
Fix the following coccicheck warning:

drivers/video/fbdev/uvesafb.c:48:12-17: WARNING: Assignment of 0/1 to
bool variable
drivers/video/fbdev/uvesafb.c:1827:3-13: WARNING: Assignment of 0/1 to
bool variable
drivers/video/fbdev/uvesafb.c:1829:3-13: WARNING: Assignment of 0/1 to
bool variable
drivers/video/fbdev/uvesafb.c:1835:3-9: WARNING: Assignment of 0/1 to
bool variable
drivers/video/fbdev/uvesafb.c:1837:3-9: WARNING: Assignment of 0/1 to
bool variable
drivers/video/fbdev/uvesafb.c:1839:3-8: WARNING: Assignment of 0/1 to
bool variable

Signed-off-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200422071845.403-1-yanaijie@huawei.com
video: uvesafb: Use scnprintf() for avoiding potential buffer overflow 2020-03-20T13:29:06+00:00 Takashi Iwai tiwai@suse.de 2020-03-11T09:32:30+00:00 06b522d6de9d7b429f368210c93d5414ead3586b Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200311093230.24900-4-tiwai@suse.de 
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200311093230.24900-4-tiwai@suse.de
video: fbdev: uvesafb: modify the static fb_ops directly 2019-12-05T08:57:31+00:00 Jani Nikula jani.nikula@intel.com 2019-12-03T16:38:46+00:00 1b78e72baee87796e37d3a7cab1aded03c91d820 Avoid modifying the fb_ops via info->fbops to let us make the pointer const in the future. Cc: linux-fbdev@vger.kernel.org Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/af63cda5de9fee3acd28e7d264f920338298bc0a.1575390740.git.jani.nikula@intel.com 
Avoid modifying the fb_ops via info->fbops to let us make the pointer
const in the future.

Cc: linux-fbdev@vger.kernel.org
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/af63cda5de9fee3acd28e7d264f920338298bc0a.1575390740.git.jani.nikula@intel.com
treewide: Add SPDX license identifier for more missed files 2019-05-21T08:50:45+00:00 Thomas Gleixner tglx@linutronix.de 2019-05-19T12:08:20+00:00 09c434b8a0047c69e48499de0107de312901e798 Add SPDX license identifiers to all files which: - Have no license information of any form - Have MODULE_LICENCE("GPL*") inside which was used in the initial scan/conversion to ignore the file These files fall under the project license, GPL v2 only. The resulting SPDX license identifier is: GPL-2.0-only Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Add SPDX license identifiers to all files which:

 - Have no license information of any form

 - Have MODULE_LICENCE("GPL*") inside which was used in the initial
   scan/conversion to ignore the file

These files fall under the project license, GPL v2 only. The resulting SPDX
license identifier is:

  GPL-2.0-only

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
video: fbdev: Use dev_get_drvdata() 2019-05-06T13:57:47+00:00 Kefeng Wang wangkefeng.wang@huawei.com 2019-05-06T13:57:47+00:00 d4a5611743a6f5d126f8cbfdbf29e12fd8d1b73f Using dev_get_drvdata directly. Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Cc: Wan ZongShun <mcuos.com@gmail.com> Cc: Kukjin Kim <kgene@kernel.org> Cc: Krzysztof Kozlowski <krzk@kernel.org> Cc: Michal Januszewski <spock@gentoo.org> Cc: Masahiro Yamada <yamada.masahiro@socionext.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> 
Using dev_get_drvdata directly.

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Wan ZongShun <mcuos.com@gmail.com>
Cc: Kukjin Kim <kgene@kernel.org>
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Michal Januszewski <spock@gentoo.org>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
fbdev: uvesafb: fix spelling mistake "memoery" -> "memory" 2018-12-20T18:13:08+00:00 Colin Ian King colin.king@canonical.com 2018-12-20T18:13:08+00:00 e0f5628bf2c163a815bb728fa7899e8dc0a4a82c There is a spelling mistake in the module parameter description, fix it. Signed-off-by: Colin Ian King <colin.king@canonical.com> Cc: Michal Januszewski <spock@gentoo.org> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> 
There is a spelling mistake in the module parameter description, fix it.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Cc: Michal Januszewski <spock@gentoo.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
treewide: kzalloc() -> kcalloc() 2018-06-12T23:19:22+00:00 Kees Cook keescook@chromium.org 2018-06-12T21:03:40+00:00 6396bb221514d2876fd6dc0aa2a1f240d99b37bb The kzalloc() function has a 2-factor argument form, kcalloc(). This patch replaces cases of: kzalloc(a * b, gfp) with: kcalloc(a * b, gfp) as well as handling cases of: kzalloc(a * b * c, gfp) with: kzalloc(array3_size(a, b, c), gfp) as it's slightly less ugly than: kzalloc_array(array_size(a, b), c, gfp) This does, however, attempt to ignore constant size factors like: kzalloc(4 * 1024, gfp) though any constants defined via macros get caught up in the conversion. Any factors with a sizeof() of "unsigned char", "char", and "u8" were dropped, since they're redundant. The Coccinelle script used for this was: // Fix redundant parens around sizeof(). @@ type TYPE; expression THING, E; @@ ( kzalloc( - (sizeof(TYPE)) * E + sizeof(TYPE) * E , ...) | kzalloc( - (sizeof(THING)) * E + sizeof(THING) * E , ...) ) // Drop single-byte sizes and redundant parens. @@ expression COUNT; typedef u8; typedef __u8; @@ ( kzalloc( - sizeof(u8) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(__u8) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(char) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(unsigned char) * (COUNT) + COUNT , ...) | kzalloc( - sizeof(u8) * COUNT + COUNT , ...) | kzalloc( - sizeof(__u8) * COUNT + COUNT , ...) | kzalloc( - sizeof(char) * COUNT + COUNT , ...) | kzalloc( - sizeof(unsigned char) * COUNT + COUNT , ...) ) // 2-factor product with sizeof(type/expression) and identifier or constant. @@ type TYPE; expression THING; identifier COUNT_ID; constant COUNT_CONST; @@ ( - kzalloc + kcalloc ( - sizeof(TYPE) * (COUNT_ID) + COUNT_ID, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * COUNT_ID + COUNT_ID, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * (COUNT_CONST) + COUNT_CONST, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * COUNT_CONST + COUNT_CONST, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * (COUNT_ID) + COUNT_ID, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * COUNT_ID + COUNT_ID, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * (COUNT_CONST) + COUNT_CONST, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * COUNT_CONST + COUNT_CONST, sizeof(THING) , ...) ) // 2-factor product, only identifiers. @@ identifier SIZE, COUNT; @@ - kzalloc + kcalloc ( - SIZE * COUNT + COUNT, SIZE , ...) // 3-factor product with 1 sizeof(type) or sizeof(expression), with // redundant parens removed. @@ expression THING; identifier STRIDE, COUNT; type TYPE; @@ ( kzalloc( - sizeof(TYPE) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(TYPE) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(TYPE) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(TYPE) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kzalloc( - sizeof(THING) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kzalloc( - sizeof(THING) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kzalloc( - sizeof(THING) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kzalloc( - sizeof(THING) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) ) // 3-factor product with 2 sizeof(variable), with redundant parens removed. @@ expression THING1, THING2; identifier COUNT; type TYPE1, TYPE2; @@ ( kzalloc( - sizeof(TYPE1) * sizeof(TYPE2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kzalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kzalloc( - sizeof(THING1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kzalloc( - sizeof(THING1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kzalloc( - sizeof(TYPE1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) | kzalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) ) // 3-factor product, only identifiers, with redundant parens removed. @@ identifier STRIDE, SIZE, COUNT; @@ ( kzalloc( - (COUNT) * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - (COUNT) * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - (COUNT) * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - (COUNT) * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kzalloc( - COUNT * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) ) // Any remaining multi-factor products, first at least 3-factor products, // when they're not all constants... @@ expression E1, E2, E3; constant C1, C2, C3; @@ ( kzalloc(C1 * C2 * C3, ...) | kzalloc( - (E1) * E2 * E3 + array3_size(E1, E2, E3) , ...) | kzalloc( - (E1) * (E2) * E3 + array3_size(E1, E2, E3) , ...) | kzalloc( - (E1) * (E2) * (E3) + array3_size(E1, E2, E3) , ...) | kzalloc( - E1 * E2 * E3 + array3_size(E1, E2, E3) , ...) ) // And then all remaining 2 factors products when they're not all constants, // keeping sizeof() as the second factor argument. @@ expression THING, E1, E2; type TYPE; constant C1, C2, C3; @@ ( kzalloc(sizeof(THING) * C2, ...) | kzalloc(sizeof(TYPE) * C2, ...) | kzalloc(C1 * C2 * C3, ...) | kzalloc(C1 * C2, ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * (E2) + E2, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(TYPE) * E2 + E2, sizeof(TYPE) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * (E2) + E2, sizeof(THING) , ...) | - kzalloc + kcalloc ( - sizeof(THING) * E2 + E2, sizeof(THING) , ...) | - kzalloc + kcalloc ( - (E1) * E2 + E1, E2 , ...) | - kzalloc + kcalloc ( - (E1) * (E2) + E1, E2 , ...) | - kzalloc + kcalloc ( - E1 * E2 + E1, E2 , ...) ) Signed-off-by: Kees Cook <keescook@chromium.org> 
The kzalloc() function has a 2-factor argument form, kcalloc(). This
patch replaces cases of:

        kzalloc(a * b, gfp)

with:
        kcalloc(a * b, gfp)

as well as handling cases of:

        kzalloc(a * b * c, gfp)

with:

        kzalloc(array3_size(a, b, c), gfp)

as it's slightly less ugly than:

        kzalloc_array(array_size(a, b), c, gfp)

This does, however, attempt to ignore constant size factors like:

        kzalloc(4 * 1024, gfp)

though any constants defined via macros get caught up in the conversion.

Any factors with a sizeof() of "unsigned char", "char", and "u8" were
dropped, since they're redundant.

The Coccinelle script used for this was:

// Fix redundant parens around sizeof().
@@
type TYPE;
expression THING, E;
@@

(
  kzalloc(
-	(sizeof(TYPE)) * E
+	sizeof(TYPE) * E
  , ...)
|
  kzalloc(
-	(sizeof(THING)) * E
+	sizeof(THING) * E
  , ...)
)

// Drop single-byte sizes and redundant parens.
@@
expression COUNT;
typedef u8;
typedef __u8;
@@

(
  kzalloc(
-	sizeof(u8) * (COUNT)
+	COUNT
  , ...)
|
  kzalloc(
-	sizeof(__u8) * (COUNT)
+	COUNT
  , ...)
|
  kzalloc(
-	sizeof(char) * (COUNT)
+	COUNT
  , ...)
|
  kzalloc(
-	sizeof(unsigned char) * (COUNT)
+	COUNT
  , ...)
|
  kzalloc(
-	sizeof(u8) * COUNT
+	COUNT
  , ...)
|
  kzalloc(
-	sizeof(__u8) * COUNT
+	COUNT
  , ...)
|
  kzalloc(
-	sizeof(char) * COUNT
+	COUNT
  , ...)
|
  kzalloc(
-	sizeof(unsigned char) * COUNT
+	COUNT
  , ...)
)

// 2-factor product with sizeof(type/expression) and identifier or constant.
@@
type TYPE;
expression THING;
identifier COUNT_ID;
constant COUNT_CONST;
@@

(
- kzalloc
+ kcalloc
  (
-	sizeof(TYPE) * (COUNT_ID)
+	COUNT_ID, sizeof(TYPE)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(TYPE) * COUNT_ID
+	COUNT_ID, sizeof(TYPE)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(TYPE) * (COUNT_CONST)
+	COUNT_CONST, sizeof(TYPE)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(TYPE) * COUNT_CONST
+	COUNT_CONST, sizeof(TYPE)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(THING) * (COUNT_ID)
+	COUNT_ID, sizeof(THING)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(THING) * COUNT_ID
+	COUNT_ID, sizeof(THING)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(THING) * (COUNT_CONST)
+	COUNT_CONST, sizeof(THING)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(THING) * COUNT_CONST
+	COUNT_CONST, sizeof(THING)
  , ...)
)

// 2-factor product, only identifiers.
@@
identifier SIZE, COUNT;
@@

- kzalloc
+ kcalloc
  (
-	SIZE * COUNT
+	COUNT, SIZE
  , ...)

// 3-factor product with 1 sizeof(type) or sizeof(expression), with
// redundant parens removed.
@@
expression THING;
identifier STRIDE, COUNT;
type TYPE;
@@

(
  kzalloc(
-	sizeof(TYPE) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kzalloc(
-	sizeof(TYPE) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kzalloc(
-	sizeof(TYPE) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kzalloc(
-	sizeof(TYPE) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(TYPE))
  , ...)
|
  kzalloc(
-	sizeof(THING) * (COUNT) * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  kzalloc(
-	sizeof(THING) * (COUNT) * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  kzalloc(
-	sizeof(THING) * COUNT * (STRIDE)
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
|
  kzalloc(
-	sizeof(THING) * COUNT * STRIDE
+	array3_size(COUNT, STRIDE, sizeof(THING))
  , ...)
)

// 3-factor product with 2 sizeof(variable), with redundant parens removed.
@@
expression THING1, THING2;
identifier COUNT;
type TYPE1, TYPE2;
@@

(
  kzalloc(
-	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  kzalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
  , ...)
|
  kzalloc(
-	sizeof(THING1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  kzalloc(
-	sizeof(THING1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
  , ...)
|
  kzalloc(
-	sizeof(TYPE1) * sizeof(THING2) * COUNT
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
|
  kzalloc(
-	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
+	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
  , ...)
)

// 3-factor product, only identifiers, with redundant parens removed.
@@
identifier STRIDE, SIZE, COUNT;
@@

(
  kzalloc(
-	(COUNT) * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kzalloc(
-	COUNT * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kzalloc(
-	COUNT * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kzalloc(
-	(COUNT) * (STRIDE) * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kzalloc(
-	COUNT * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kzalloc(
-	(COUNT) * STRIDE * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kzalloc(
-	(COUNT) * (STRIDE) * (SIZE)
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
|
  kzalloc(
-	COUNT * STRIDE * SIZE
+	array3_size(COUNT, STRIDE, SIZE)
  , ...)
)

// Any remaining multi-factor products, first at least 3-factor products,
// when they're not all constants...
@@
expression E1, E2, E3;
constant C1, C2, C3;
@@

(
  kzalloc(C1 * C2 * C3, ...)
|
  kzalloc(
-	(E1) * E2 * E3
+	array3_size(E1, E2, E3)
  , ...)
|
  kzalloc(
-	(E1) * (E2) * E3
+	array3_size(E1, E2, E3)
  , ...)
|
  kzalloc(
-	(E1) * (E2) * (E3)
+	array3_size(E1, E2, E3)
  , ...)
|
  kzalloc(
-	E1 * E2 * E3
+	array3_size(E1, E2, E3)
  , ...)
)

// And then all remaining 2 factors products when they're not all constants,
// keeping sizeof() as the second factor argument.
@@
expression THING, E1, E2;
type TYPE;
constant C1, C2, C3;
@@

(
  kzalloc(sizeof(THING) * C2, ...)
|
  kzalloc(sizeof(TYPE) * C2, ...)
|
  kzalloc(C1 * C2 * C3, ...)
|
  kzalloc(C1 * C2, ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(TYPE) * (E2)
+	E2, sizeof(TYPE)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(TYPE) * E2
+	E2, sizeof(TYPE)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(THING) * (E2)
+	E2, sizeof(THING)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	sizeof(THING) * E2
+	E2, sizeof(THING)
  , ...)
|
- kzalloc
+ kcalloc
  (
-	(E1) * E2
+	E1, E2
  , ...)
|
- kzalloc
+ kcalloc
  (
-	(E1) * (E2)
+	E1, E2
  , ...)
|
- kzalloc
+ kcalloc
  (
-	E1 * E2
+	E1, E2
  , ...)
)

Signed-off-by: Kees Cook <keescook@chromium.org>
video: uvesafb: Fix integer overflow in allocation 2018-06-12T23:19:22+00:00 Kees Cook keescook@chromium.org 2018-05-11T08:24:12+00:00 9f645bcc566a1e9f921bdae7528a01ced5bc3713 cmap->len can get close to INT_MAX/2, allowing for an integer overflow in allocation. This uses kmalloc_array() instead to catch the condition. Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com> Fixes: 8bdb3a2d7df48 ("uvesafb: the driver core") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> 
cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: 8bdb3a2d7df48 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Merge tag 'fbdev-v4.14' of git://github.com/bzolnier/linux 2017-09-14T20:33:33+00:00 Linus Torvalds torvalds@linux-foundation.org 2017-09-14T20:33:33+00:00 503f04530fec97f93673ae9048b5312cc4455cfe Pull fbdev updates from Bartlomiej Zolnierkiewicz: - make fbcon a built-time depency for fbdev (fbcon was tristate option before, now it is a bool) - this is a first step in preparations for making console_lock usage saner (currently it acts like the BKL for all things fbdev/fbcon) (Daniel Vetter) - add fbcon=margin:<color> command line option to select the fbcon margin color (David Lechner) - add DMI quirk table for x86 systems which need fbcon rotation (devices like Asus T100HA, GPD Pocket, the GPD win and the I.T.Works TW891) (Hans de Goede) - fix 1bpp logo support for unusual width (needed by LEGO MINDSTORMS EV3) (David Lechner) - enable Xilinx FB driver for ARM ZynqMP platform (Michal Simek) - fix use after free in the error path of udlfb driver (Anton Vasilyev) - fix error return code handling in pxa3xx_gcu driver (Gustavo A. R. Silva) - fix bootparams.screeninfo arguments checking in vgacon (Jan H. Schönherr) - do not leak uninitialized padding in clk to userspace in the debug code of atyfb driver (Vladis Dronov) - fix compiler warnings in fbcon code and matroxfb driver (Arnd Bergmann) - convert fbdev susbsytem to using %pOF instead of full_name (Rob Herring) - structures constifications (Arvind Yadav, Bhumika Goyal, Gustavo A. R. Silva, Julia Lawall) - misc cleanups (Gustavo A. R. Silva, Hyun Kwon, Julia Lawall, Kuninori Morimoto, Lynn Lei) * tag 'fbdev-v4.14' of git://github.com/bzolnier/linux: (75 commits) video/console: Update BIOS dates list for GPD win console rotation DMI quirk video/console: Add rotated LCD-panel DMI quirk for the VIOS LTH17 video: fbdev: sis: fix duplicated code for different branches video: fbdev: make fb_var_screeninfo const video: fbdev: aty: do not leak uninitialized padding in clk to userspace vgacon: Prevent faulty bootparams.screeninfo from causing harm video: fbdev: make fb_videomode const video/console: Add new BIOS date for GPD pocket to dmi quirk table fbcon: remove restriction on margin color video: ARM CLCD: constify amba_id video: fm2fb: constify zorro_device_id video: fbdev: annotate fb_fix_screeninfo with const and __initconst omapfb: constify omap_video_timings structures video: fbdev: udlfb: Fix use after free on dlfb_usb_probe error path fbdev: i810: make fb_ops const fbdev: matrox: make fb_ops const video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe() video: fbdev: Enable Xilinx FB for ZynqMP video: fbdev: Fix multiple style issues in xilinxfb video: fbdev: udlfb: constify usb_device_id. ... 
Pull fbdev updates from Bartlomiej Zolnierkiewicz:

 - make fbcon a built-time depency for fbdev (fbcon was tristate option
   before, now it is a bool) - this is a first step in preparations for
   making console_lock usage saner (currently it acts like the BKL for
   all things fbdev/fbcon) (Daniel Vetter)

 - add fbcon=margin:<color> command line option to select the fbcon
   margin color (David Lechner)

 - add DMI quirk table for x86 systems which need fbcon rotation
   (devices like Asus T100HA, GPD Pocket, the GPD win and the I.T.Works
   TW891) (Hans de Goede)

 - fix 1bpp logo support for unusual width (needed by LEGO MINDSTORMS
   EV3) (David Lechner)

 - enable Xilinx FB driver for ARM ZynqMP platform (Michal Simek)

 - fix use after free in the error path of udlfb driver (Anton Vasilyev)

 - fix error return code handling in pxa3xx_gcu driver (Gustavo A. R.
   Silva)

 - fix bootparams.screeninfo arguments checking in vgacon (Jan H.
   Schönherr)

 - do not leak uninitialized padding in clk to userspace in the debug
   code of atyfb driver (Vladis Dronov)

 - fix compiler warnings in fbcon code and matroxfb driver (Arnd
   Bergmann)

 - convert fbdev susbsytem to using %pOF instead of full_name (Rob
   Herring)

 - structures constifications (Arvind Yadav, Bhumika Goyal, Gustavo A.
   R. Silva, Julia Lawall)

 - misc cleanups (Gustavo A. R. Silva, Hyun Kwon, Julia Lawall, Kuninori
   Morimoto, Lynn Lei)

* tag 'fbdev-v4.14' of git://github.com/bzolnier/linux: (75 commits)
  video/console: Update BIOS dates list for GPD win console rotation DMI quirk
  video/console: Add rotated LCD-panel DMI quirk for the VIOS LTH17
  video: fbdev: sis: fix duplicated code for different branches
  video: fbdev: make fb_var_screeninfo const
  video: fbdev: aty: do not leak uninitialized padding in clk to userspace
  vgacon: Prevent faulty bootparams.screeninfo from causing harm
  video: fbdev: make fb_videomode const
  video/console: Add new BIOS date for GPD pocket to dmi quirk table
  fbcon: remove restriction on margin color
  video: ARM CLCD: constify amba_id
  video: fm2fb: constify zorro_device_id
  video: fbdev: annotate fb_fix_screeninfo with const and __initconst
  omapfb: constify omap_video_timings structures
  video: fbdev: udlfb: Fix use after free on dlfb_usb_probe error path
  fbdev: i810: make fb_ops const
  fbdev: matrox: make fb_ops const
  video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe()
  video: fbdev: Enable Xilinx FB for ZynqMP
  video: fbdev: Fix multiple style issues in xilinxfb
  video: fbdev: udlfb: constify usb_device_id.
  ...