linux-toradex.git/drivers/video/fbdev, branch v4.15-rc2

Merge tag 'fbdev-v4.15' of git://github.com/bzolnier/linux

2017-11-21T07:50:24+00:00

Pull fbdev updates from Bartlomiej Zolnierkiewicz:
 "There is nothing really major here (though removal of the dead igafb
  driver stands out in diffstat).

  Summary:

   - convert timers to use timer_setup() (Kees Cook, Thierry Reding)

   - fix panels support on iMX boards in mxsfb driver (Stefan Agner)

   - fix timeout on EDID read in udlfb driver (Ladislav Michl)

   - add missing modes to fix out of bounds access in controlfb driver
     (Geert Uytterhoeven)

   - update initialisation paths in sa1100fb driver to be more robust
     (Russell King)

   - fix error handling path of ->probe method in au1200fb driver
     (Christophe JAILLET)

   - fix handling of cases when either panel or crt is defined in
     sm501fb driver (Sudip Mukherjee, Colin Ian King)

   - add ability to the Goldfish FB driver to be recognized by OS via DT
     (Aleksandar Markovic)

   - structures constifications (Bhumika Goyal)

   - misc fixes (Allen Pais, Gustavo A. R. Silva, Dan Carpenter)

   - misc cleanups (Colin Ian King, Himanshu Jha, Markus Elfring)

   - remove dead igafb driver"

* tag 'fbdev-v4.15' of git://github.com/bzolnier/linux: (42 commits)
  OMAPFB: prevent buffer underflow in omapfb_parse_vram_param()
  video: fbdev: sm501fb: fix potential null pointer dereference on fbi
  fbcon: Initialize ops->info early
  video: fbdev: Convert timers to use timer_setup()
  video: fbdev: pxa3xx_gcu: Convert timers to use timer_setup()
  fbdev: controlfb: Add missing modes to fix out of bounds access
  video: fbdev: sis_main: mark expected switch fall-throughs
  video: fbdev: cirrusfb: mark expected switch fall-throughs
  video: fbdev: aty: radeon_pm: mark expected switch fall-throughs
  video: fbdev: sm501fb: mark expected switch fall-through in sm501fb_blank_crt
  video: fbdev: intelfb: remove redundant variables
  video/fbdev/dnfb: Use common error handling code in dnfb_probe()
  sm501fb: suspend and resume fb if it exists
  sm501fb: unregister framebuffer only if registered
  sm501fb: deallocate colormap only if allocated
  video: goldfishfb: Add support for device tree bindings
  Documentation: Add device tree binding for Goldfish FB driver
  video: udlfb: Fix read EDID timeout
  video: fbdev: remove dead igafb driver
  video: fbdev: mxsfb: fix pixelclock polarity
  ...

Merge branch 'work.get_user_pages_fast' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-11-17T20:38:51+00:00

Pull get_user_pages_fast() conversion from Al Viro:
 "A bunch of places switched to get_user_pages_fast()"

* 'work.get_user_pages_fast' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ceph: use get_user_pages_fast()
  pvr2fs: use get_user_pages_fast()
  atomisp: use get_user_pages_fast()
  st: use get_user_pages_fast()
  via_dmablit(): use get_user_pages_fast()
  fsl_hypervisor: switch to get_user_pages_fast()
  rapidio: switch to get_user_pages_fast()
  vchiq_2835_arm: switch to get_user_pages_fast()

OMAPFB: prevent buffer underflow in omapfb_parse_vram_param()

2017-11-17T16:21:49+00:00

We cap the upper bound of "fbnum" but we also need to check for
negatives or make the type unsigned.

Signed-off-by: Dan Carpenter 
Cc: Tomi Valkeinen 
Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: sm501fb: fix potential null pointer dereference on fbi

2017-11-17T16:21:48+00:00

The pointer fbi is dereferenced with par = fbi->par before there is a
null check on fbi, hence there is a potential null pointer dereference
on a null par.  Fix this by moving the dereference after the null
pointer check.

Detected by CoverityScan, CID#1461301 ("Dereference before null check")

Signed-off-by: Colin Ian King 
Cc: Sudip Mukherjee 
Signed-off-by: Bartlomiej Zolnierkiewicz

fbcon: Initialize ops->info early

2017-11-13T17:16:31+00:00

During console takeover, which happens for all DRM/KMS setups using the
fbdev helpers, fbcon_startup() is called before fbcon_init() and as a
result con2fb_acquire_newinfo() will not be called (info->fbcon_par was
set to non-NULL in fbcon_startup()) to assign ops->info.

This causes the cursor_timer_handler() to unreference a NULL pointer.

Avoid this by unconditionally assigning ops->info during fbcon_startup()
so that it will be available early, but keep the additional assignment
in con2fb_acquire_newinfo() to support console remapping at runtime.

Signed-off-by: Thierry Reding 
Cc: Kees Cook 
Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: Convert timers to use timer_setup()

2017-11-10T15:34:52+00:00

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly. One tracking pointer was added.

Signed-off-by: Kees Cook 
Cc: Benjamin Herrenschmidt 
Cc: Tomi Valkeinen 
Cc: David Lechner 
Cc: Daniel Vetter 
Cc: Sean Paul 
Cc: Jean Delvare 
Cc: Hans de Goede 
Cc: "Gustavo A. R. Silva" 
[b.zolnierkie: ported it over pxa3xx_gcu changes]
Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: pxa3xx_gcu: Convert timers to use timer_setup()

2017-11-10T15:34:51+00:00

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.

This also fixes the use of the "priv" variable in QERROR(), since it was
pointing to struct timer_list, not struct pxa3xx_gcu_priv.

Signed-off-by: Kees Cook 
Cc: "Gustavo A. R. Silva" 
Cc: Himanshu Jha 
[b.zolnierkie: trivial build fixup]
Signed-off-by: Bartlomiej Zolnierkiewicz

fbdev: controlfb: Add missing modes to fix out of bounds access

2017-11-09T17:09:33+00:00

Dan's static analysis says:

    drivers/video/fbdev/controlfb.c:560 control_setup()
    error: buffer overflow 'control_mac_modes' 20 <= 21

Indeed, control_mac_modes[] has only 20 elements, while VMODE_MAX is 22,
which may lead to an out of bounds read when parsing vmode commandline
options.

The bug was introduced in v2.4.5.6, when 2 new modes were added to
macmodes.h, but control_mac_modes[] wasn't updated:

https://kernel.opensuse.org/cgit/kernel/diff/include/video/macmodes.h?h=v2.5.2&id=29f279c764808560eaceb88fef36cbc35c529aad

Augment control_mac_modes[] with the two new video modes to fix this.

Reported-by: Dan Carpenter 
Signed-off-by: Geert Uytterhoeven 
Cc: Dan Carpenter 
Cc: Benjamin Herrenschmidt 
Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: sis_main: mark expected switch fall-throughs

2017-11-09T17:09:33+00:00

In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.

Addresses-Coverity-ID: 115025
Addresses-Coverity-ID: 115026
Addresses-Coverity-ID: 115027
Addresses-Coverity-ID: 115028
Signed-off-by: Gustavo A. R. Silva 
Cc: Thomas Winischhofer 
Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: cirrusfb: mark expected switch fall-throughs

2017-11-09T17:09:32+00:00

In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.

Notice that in this particular case I placed the "fall through" comment
on its own line, which is what GCC is expecting to find.

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Bartlomiej Zolnierkiewicz