linux-toradex.git/drivers/video/sis, branch v2.6.34.8

drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory

2011-01-06T23:08:00+00:00

commit fd02db9de73faebc51240619c7c7f99bee9f65c7 upstream.

The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes
of uninitialized stack memory, because the "reserved" member of the
fb_vblank struct declared on the stack is not altered or zeroed before
being copied back to the user.  This patch takes care of it.

Signed-off-by: Dan Rosenberg 
Cc: Thomas Winischhofer 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

fbdev: remove obsolete CONFIG_FB_SOFT_CURSOR

2010-03-12T23:52:34+00:00

The config Option FB_SOFT_BUFFER was removed in
c465e05a03209651078b95686158648fd7ed84c5 ("fbcon/fbdev: Move softcursor
out of fbdev to fbcon").

While moving to fbcon this single driver has it left as a select in
KConfig / #ifdef in source.  This last occurence is removed here so the
option is really gone

Signed-off-by: Christoph Egger 
Cc: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbdev: TV_PALN bit set twice in sisfb_detect_VB_connect()

2009-12-16T15:20:01+00:00

The TV_PALN bit was tested twice, replace one by TV_PALM.

Signed-off-by: Roel Kluin 
Cc: Thomas Winischhofer 
Cc: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

sisfb: change SiS_DDC_Port type to SISIOADDRESS

2009-09-23T14:39:57+00:00

The patch enables the driver to be used on platforms such as ARM where an
I/O address is a 32-bit memory address.

The patch avoids the following kernel oops:

debian:~# modprobe sisfb
[   73.070000] sisfb: Video ROM found
[   73.080000] sisfb: Video RAM at 0x80000000, mapped to 0xe0a00000, size 1024k
[   73.090000] sisfb: MMIO at 0x84080000, mapped to 0xe0b80000, size 256k
[   73.090000] sisfb: Memory heap starting at 800K, size 32K
[   73.360000] Unable to handle kernel paging request at virtual address 6e000844
[   73.380000] pgd = df230000
[   73.380000] [6e000844] *pgd=00000000
[   73.380000] Internal error: Oops: 8f5 [#1]
[   73.380000] Modules linked in: sisfb(+) fb cfbcopyarea cfbimgblt cfbfillrect
[   73.380000] CPU: 0    Not tainted  (2.6.31-iop32x #1)
[   73.380000] PC is at SiS_SetRegANDOR+0x10/0x38 [sisfb]
[   73.380000] LR is at SiS_SetSCLKHigh+0x38/0x94 [sisfb]
[   73.380000] pc : []    lr : []    psr: 60000013
[   73.380000] sp : df38fd00  ip : 6e000000  fp : 00000002
[   73.380000] r10: 00000108  r9 : 00000000  r8 : 00000108
[   73.380000] r7 : df064258  r6 : 00000110  r5 : 6e000844  r4 : 0000010a
[   73.380000] r3 : 00000001  r2 : 0000000e  r1 : 00000011  r0 : 00000844
[   73.380000] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   73.380000] Control: 0000397f  Table: bf230000  DAC: 00000015
[   73.380000] Process modprobe (pid: 1849, stack limit = 0xdf38e270)
[   73.380000] Stack: (0xdf38fd00 to 0xdf390000)
[   73.380000] fd00: 0000010a 00000108 df064258 df064258 df064258 00000000 00000000 bf02c4e0
[   73.380000] fd20: 00000114 bf02c50c 00000013 00000114 0000010a df064258 00000000 bf02c980
[   73.380000] fd40: 00009c66 00000004 00000001 df064250 a0010000 a6a2a0a0 df064250 00000003
[   73.380000] fd60: df064250 00000000 df064258 0000fffd 00000000 00000000 00000000 bf033948
[   73.380000] fd80: 00000000 00000000 00000000 bf019e2c 00000000 df064a70 bf03b470 00010000
[   73.380000] fda0: 00000000 df064250 00000000 df831c00 00000012 bf039f70 00000000 c00abed8
[   73.380000] fdc0: 000008a6 000008a4 df0649b0 df064878 df064258 df064000 00000000 00000000
[   73.380000] fde0: 00000001 00008000 00000001 00030000 df81c930 bf049f88 df831c00 00000000
[   73.380000] fe00: bf049f58 df3952a0 c0447708 bf049f88 bf049fe0 c0191980 df831c00 c0191b10
[   73.380000] fe20: df831c58 bf049f58 df831c00 bf04aca8 df3952a0 df831c58 df831c58 bf049f88
[   73.380000] fe40: c01ba1b4 c01ba0a0 df831c58 df831c8c bf049f88 c01ba1b4 df3952a0 00000000
[   73.380000] fe60: c03e265c c01ba240 00000000 df38fe78 bf049f88 c01b990c df812938 df81b8d0
[   73.380000] fe80: df3952a0 df807780 00000000 00000060 bf049f88 c01b9224 bf0429c8 00000000
[   73.380000] fea0: bf049f58 00000000 bf049f88 00000000 00000000 bf04aea8 00000000 c01ba4e4
[   73.380000] fec0: e09861a0 bf049f58 00000000 bf049f88 00000000 c0191f20 00000000 00000000
[   73.380000] fee0: c03f7bac bf04d418 0000fff2 0000fff1 bf04ad08 0002f260 0002f260 e0986038
[   73.380000] ff00: e0986150 e098568b df143340 e0990280 00000036 c03d8b00 fffffffd 00000000
[   73.380000] ff20: bf04acfc 00000000 fffffffc 0003cf4b 00018098 c03f7bac 00000000 bf04d000
[   73.380000] ff40: df38e000 00000000 bedc0984 c00272a4 ffffffff c005bc88 00000000 00000000
[   73.380000] ff60: 0003cf4b 0003cf4b 00018098 bf04acfc 00000000 c0027fe8 df38e000 00000000
[   73.380000] ff80: bedc0984 c006882c 00001000 00000003 00000000 00009064 00000000 00008edc
[   73.380000] ffa0: 00000080 c0027e20 00009064 00000000 4014e000 0003cf4b 00018098 0003cf4b
[   73.380000] ffc0: 00009064 00000000 00008edc 00000080 00000000 00000000 40025000 bedc0984
[   73.380000] ffe0: 00000000 bedc08fc 0000b6b0 400e8f34 60000010 4014e000 00000000 00000000
[   73.380000] [] (SiS_SetRegANDOR+0x10/0x38 [sisfb]) from [] (0xdf064258)
[   73.380000] Code: e92d0030 e20110ff e280546e e3a0c46e (e5c51000)
[   73.680000] ---[ end trace 62a93e01df37a5f2 ]---

Signed-off-by: Aaro Koskinen 
Cc: Thomas Winischhofer 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

sisfb: read buffer overflow

2009-09-23T14:39:51+00:00

If called with mode_idx = 1, rate = 68, a read occurs from
sisfb_vrate[-1].refresh.

Signed-off-by: Roel Kluin 
Cc: Krzysztof Helt 
Cc: Thomas Winischhofer 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

sisfb: fix regression with uninitalized fb_info->mm_lock mutex

2009-07-06T20:44:37+00:00

Remove redundant call to the sisfb_get_fix() before sis frambuffer is
registered.

This fixes a problem with uninitialized the fb_info->mm_lock mutex
introduced by the commit 537a1bf059f " fbdev: add mutex for fb_mmap
locking"

Signed-off-by: Krzysztof Helt 
Tested-by: Wu Zhangjin 
Signed-off-by: Linus Torvalds

fbdev: add mutex for fb_mmap locking

2009-07-01T01:56:00+00:00

Add a mutex to avoid a circular locking problem between the mm layer
semaphore and fbdev ioctl mutex through the fb_mmap() call.

Also, add mutex to all places where smem_start and smem_len fields change
so the mutex inside the fb_mmap() is actually used.  Changing of these
fields before calling the framebuffer_register() are not mutexed.

This is 2.6.31 material.  It removes one lockdep (fb_mmap() and
register_framebuffer()) but there is still another one (fb_release() and
register_framebuffer()).  It also cleans up handling of the smem_start and
smem_len fields used by mutexed section of the fb_mmap().

Signed-off-by: Krzysztof Helt 
Cc: Peter Zijlstra 
Cc: "Rafael J. Wysocki" 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fbdev: use framebuffer_release() for freeing fb_info structures

2009-06-17T02:48:00+00:00

Use the framebuffer_release() for freeing fb_info structures allocated
with framebuffer_alloc().

Signed-off-by: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

sisfb: fix color component length for pseudocolor modes

2009-04-13T22:04:30+00:00

sisfb incorrectly sets the length of the color fields to 6 bits
for PSEUDOCOLOR modes, even though 8 bits are always used per pixel.
Fix this by setting the length to 8.

Signed-off-by: Michal Januszewski 
Cc: Thomas Winischhofer 
Acked-by: Krzysztof Helt 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

video/sis/: remove compat code

2008-07-24T17:47:37+00:00

This patch removes compat code for older kernel versions.

Signed-off-by: Adrian Bunk 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds