linux-toradex.git/drivers/video, branch v2.6.35.8 Linux kernel for Apalis and Colibri modules drivers/video/via/ioctl.c: prevent reading uninitialized stack memory 2010-09-27T00:18:36+00:00 Dan Rosenberg drosenberg@vsecurity.com 2010-09-15T23:08:24+00:00 63e70525feb93ddfdadd2eb81d0a71a055343d99 commit b4aaa78f4c2f9cde2f335b14f4ca30b01f9651ca upstream. The VIAFB_GET_INFO device ioctl allows unprivileged users to read 246 bytes of uninitialized stack memory, because the "reserved" member of the viafb_ioctl_info struct declared on the stack is not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit b4aaa78f4c2f9cde2f335b14f4ca30b01f9651ca upstream.

The VIAFB_GET_INFO device ioctl allows unprivileged users to read 246
bytes of uninitialized stack memory, because the "reserved" member of
the viafb_ioctl_info struct declared on the stack is not altered or
zeroed before being copied back to the user.  This patch takes care of
it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory 2010-09-27T00:18:27+00:00 Dan Rosenberg drosenberg@vsecurity.com 2010-09-22T20:05:09+00:00 a3bec3ef92a0395e64b5ac67640f420bfabe1bab commit fd02db9de73faebc51240619c7c7f99bee9f65c7 upstream. The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes of uninitialized stack memory, because the "reserved" member of the fb_vblank struct declared on the stack is not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Cc: Thomas Winischhofer <thomas@winischhofer.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit fd02db9de73faebc51240619c7c7f99bee9f65c7 upstream.

The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes
of uninitialized stack memory, because the "reserved" member of the
fb_vblank struct declared on the stack is not altered or zeroed before
being copied back to the user.  This patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
matroxfb: fix incorrect use of memcpy_toio() 2010-08-26T23:45:54+00:00 Ondrej Zary linux@rainbow-software.org 2010-08-19T21:13:25+00:00 e5c9bc34a675a7f9d88c63fd63815a531306a36e commit c81476df1b4241aefba4ff83a7701b3a926bd7ce upstream. Screen is completely corrupted since 2.6.34. Bisection revealed that it's caused by commit 6175ddf06b61720 ("x86: Clean up mem*io functions."). H. Peter Anvin explained that memcpy_toio() does not copy data in 32bit chunks anymore on x86. Signed-off-by: Ondrej Zary <linux@rainbow-software.org> Cc: Brian Gerst <brgerst@gmail.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Petr Vandrovec <vandrove@vc.cvut.cz> Cc: Jean Delvare <khali@linux-fr.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit c81476df1b4241aefba4ff83a7701b3a926bd7ce upstream.

Screen is completely corrupted since 2.6.34.  Bisection revealed that it's
caused by commit 6175ddf06b61720 ("x86: Clean up mem*io functions.").

H.  Peter Anvin explained that memcpy_toio() does not copy data in 32bit
chunks anymore on x86.

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Petr Vandrovec <vandrove@vc.cvut.cz>
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/video/w100fb.c: ignore void return value / fix build failure 2010-08-13T20:30:46+00:00 Peter Huewe peterhuewe@gmx.de 2010-08-10T00:18:23+00:00 ef5cd7c116b865dee3955c6e2c9ca05dd6268ade commit fa260c00c1aa5c657793a7221e40d2400df5afd8 upstream. Fix a build failure "error: void value not ignored as it ought to be" by removing an assignment of a void return value. The functionality of the code is not changed. Signed-off-by: Peter Huewe <peterhuewe@gmx.de> Acked-by: Henrik Kretzschmar <henne@nachtwindheim.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit fa260c00c1aa5c657793a7221e40d2400df5afd8 upstream.

Fix a build failure "error: void value not ignored as it ought to be"
by removing an assignment of a void return value.  The functionality of
the code is not changed.

Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Acked-by: Henrik Kretzschmar <henne@nachtwindheim.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Merge master.kernel.org:/home/rmk/linux-2.6-arm 2010-07-31T02:02:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2010-07-31T02:02:51+00:00 a63ecd835f075b21d7d5cef9580447f5fbb36263 * master.kernel.org:/home/rmk/linux-2.6-arm: cyber2000fb: fix console in truecolor modes cyber2000fb: fix machine hang on module load SA1111: Eliminate use after free ARM: Fix Versatile/Realview/VExpress MMC card detection sense ARM: 6279/1: highmem: fix SMP preemption bug in kmap_high_l1_vipt ARM: Add barriers to io{read,write}{8,16,32} accessors as well ARM: 6273/1: Add barriers to the I/O accessors if ARM_DMA_MEM_BUFFERABLE ARM: 6272/1: Convert L2x0 to use the IO relaxed operations ARM: 6271/1: Introduce *_relaxed() I/O accessors ARM: 6275/1: ux500: don't use writeb() in uncompress.h ARM: 6270/1: clean files in arch/arm/boot/compressed/ ARM: Fix csum_partial_copy_from_user() 
* master.kernel.org:/home/rmk/linux-2.6-arm:
  cyber2000fb: fix console in truecolor modes
  cyber2000fb: fix machine hang on module load
  SA1111: Eliminate use after free
  ARM: Fix Versatile/Realview/VExpress MMC card detection sense
  ARM: 6279/1: highmem: fix SMP preemption bug in kmap_high_l1_vipt
  ARM: Add barriers to io{read,write}{8,16,32} accessors as well
  ARM: 6273/1: Add barriers to the I/O accessors if ARM_DMA_MEM_BUFFERABLE
  ARM: 6272/1: Convert L2x0 to use the IO relaxed operations
  ARM: 6271/1: Introduce *_relaxed() I/O accessors
  ARM: 6275/1: ux500: don't use writeb() in uncompress.h
  ARM: 6270/1: clean files in arch/arm/boot/compressed/
  ARM: Fix csum_partial_copy_from_user()
cyber2000fb: fix console in truecolor modes 2010-07-30T22:29:33+00:00 Ondrej Zary linux@rainbow-software.org 2010-07-29T20:40:54+00:00 e76df4d33973bd9b963d0cce05749b090cc14936 Return value was not set to 0 in setcolreg() with truecolor modes. This causes fb_set_cmap() to abort after first color, resulting in blank palette - and blank console in 24bpp and 32bpp modes. Signed-off-by: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
Return value was not set to 0 in setcolreg() with truecolor modes. This causes
fb_set_cmap() to abort after first color, resulting in blank palette - and
blank console in 24bpp and 32bpp modes.

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
cyber2000fb: fix machine hang on module load 2010-07-30T22:29:33+00:00 Ondrej Zary linux@rainbow-software.org 2010-07-29T20:32:20+00:00 00b4703f03ce04bd7f2f912fd05a243096ab826f I was testing two CyberPro 2000 based PCI cards on x86 and the machine always hanged completely when the cyber2000fb module was loaded. It seems that the card hangs when some registers are accessed too quickly after writing RAMDAC control register. With this patch, both card work. Add delay after RAMDAC control register write to prevent hangs on module load. Signed-off-by: Ondrej Zary <linux@rainbow-software.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> 
I was testing two CyberPro 2000 based PCI cards on x86 and the machine always
hanged completely when the cyber2000fb module was loaded. It seems that the
card hangs when some registers are accessed too quickly after writing RAMDAC
control register. With this patch, both card work.

Add delay after RAMDAC control register write to prevent hangs on module load.

Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
VIDEO: Au1100fb: Fix section mismatch 2010-07-26T18:08:15+00:00 Ralf Baechle ralf@linux-mips.org 2010-07-26T18:08:15+00:00 362992b19e7cc583f0f1987b6a6f0b3ae3b021fd WARNING: drivers/video/built-in.o(.data+0x360): Section mismatch in reference from the variable au1100fb_driver to the function .init.text:au1100fb_drv_probe() The variable au1100fb_driver references the function __init au1100fb_drv_probe() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console, Fixing which triggers of a slew of further mismatches: WARNING: drivers/video/built-in.o(.devinit.text+0xc0): Section mismatch in reference from the function au1100fb_drv_probe() to the variable .init.data:au1100fb_fix The function __devinit au1100fb_drv_probe() references a variable __initdata au1100fb_fix. If au1100fb_fix is only used by au1100fb_drv_probe then annotate au1100fb_fix with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x21c): Section mismatch in reference from the function au1100fb_drv_probe() to the variable .init.data:au1100fb_var The function __devinit au1100fb_drv_probe() references a variable __initdata au1100fb_var. If au1100fb_var is only used by au1100fb_drv_probe then annotate au1100fb_var with a matching annotation. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> 
WARNING: drivers/video/built-in.o(.data+0x360): Section mismatch in reference from the variable au1100fb_driver to the function .init.text:au1100fb_drv_probe()
The variable au1100fb_driver references
the function __init au1100fb_drv_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console,

Fixing which triggers of a slew of further mismatches:

WARNING: drivers/video/built-in.o(.devinit.text+0xc0): Section mismatch in reference from the function au1100fb_drv_probe() to the variable .init.data:au1100fb_fix
The function __devinit au1100fb_drv_probe() references
a variable __initdata au1100fb_fix.
If au1100fb_fix is only used by au1100fb_drv_probe then
annotate au1100fb_fix with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x21c): Section mismatch in reference from the function au1100fb_drv_probe() to the variable .init.data:au1100fb_var
The function __devinit au1100fb_drv_probe() references
a variable __initdata au1100fb_var.
If au1100fb_var is only used by au1100fb_drv_probe then
annotate au1100fb_var with a matching annotation.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
VIDEO: PMAGB-B: Fix section mismatch 2010-07-26T18:08:15+00:00 Ralf Baechle ralf@linux-mips.org 2010-07-26T18:08:15+00:00 5b1638d94080bb9b8dd9a458405502a50064ca56 WARNING: drivers/built-in.o(.devinit.text+0xc0): Section mismatch in reference from the function pmagbafb_probe() to the variable .init.data:pmagbafb_fix The function __devinit pmagbafb_probe() references a variable __initdata pmagbafb_fix. If pmagbafb_fix is only used by pmagbafb_probe then annotate pmagbafb_fix with a matching annotation. Fixing this one triggers a few more mismatches in order: WARNING: drivers/video/built-in.o(.devinit.text+0x414): Section mismatch in reference from the function pmagbbfb_probe() to the variable .init.data:pmagbbfb_fix The function __devinit pmagbbfb_probe() references a variable __initdata pmagbbfb_fix. If pmagbbfb_fix is only used by pmagbbfb_probe then annotate pmagbbfb_fix with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x45c): Section mismatch in reference from the function pmagbbfb_probe() to the variable .init.data:pmagbbfb_defined The function __devinit pmagbbfb_probe() references a variable __initdata pmagbbfb_defined. If pmagbbfb_defined is only used by pmagbbfb_probe then annotate pmagbbfb_defined with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x5fc): Section mismatch in reference from the function pmagbbfb_probe() to the function .init.text:pmagbbfb_screen_setup() The function __devinit pmagbbfb_probe() references a function __init pmagbbfb_screen_setup(). If pmagbbfb_screen_setup is only used by pmagbbfb_probe then annotate pmagbbfb_screen_setup with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x6f4): Section mismatch in reference from the function pmagbbfb_probe() to the function .init.text:pmagbbfb_osc_setup() The function __devinit pmagbbfb_probe() references a function __init pmagbbfb_osc_setup(). If pmagbbfb_osc_setup is only used by pmagbbfb_probe then annotate pmagbbfb_osc_setup with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x5f8): Section mismatch in reference from the function pmagbbfb_osc_setup() to the variable .init.data:pmagbbfb_freqs.15993 The function __devinit pmagbbfb_osc_setup() references a variable __initdata pmagbbfb_freqs.15993. If pmagbbfb_freqs.15993 is only used by pmagbbfb_osc_setup then annotate pmagbbfb_freqs.15993 with a matching annotation. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> 
WARNING: drivers/built-in.o(.devinit.text+0xc0): Section mismatch in reference from the function pmagbafb_probe() to the variable .init.data:pmagbafb_fix
The function __devinit pmagbafb_probe() references
a variable __initdata pmagbafb_fix.
If pmagbafb_fix is only used by pmagbafb_probe then
annotate pmagbafb_fix with a matching annotation.

Fixing this one triggers a few more mismatches in order:

WARNING: drivers/video/built-in.o(.devinit.text+0x414): Section mismatch in reference from the function pmagbbfb_probe() to the variable .init.data:pmagbbfb_fix
The function __devinit pmagbbfb_probe() references
a variable __initdata pmagbbfb_fix.
If pmagbbfb_fix is only used by pmagbbfb_probe then
annotate pmagbbfb_fix with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x45c): Section mismatch in reference from the function pmagbbfb_probe() to the variable .init.data:pmagbbfb_defined
The function __devinit pmagbbfb_probe() references
a variable __initdata pmagbbfb_defined.
If pmagbbfb_defined is only used by pmagbbfb_probe then
annotate pmagbbfb_defined with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x5fc): Section mismatch in reference from the function pmagbbfb_probe() to the function .init.text:pmagbbfb_screen_setup()
The function __devinit pmagbbfb_probe() references
a function __init pmagbbfb_screen_setup().
If pmagbbfb_screen_setup is only used by pmagbbfb_probe then
annotate pmagbbfb_screen_setup with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x6f4): Section mismatch in reference from the function pmagbbfb_probe() to the function .init.text:pmagbbfb_osc_setup()
The function __devinit pmagbbfb_probe() references
a function __init pmagbbfb_osc_setup().
If pmagbbfb_osc_setup is only used by pmagbbfb_probe then
annotate pmagbbfb_osc_setup with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x5f8): Section mismatch in reference from the function pmagbbfb_osc_setup() to the variable .init.data:pmagbbfb_freqs.15993
The function __devinit pmagbbfb_osc_setup() references
a variable __initdata pmagbbfb_freqs.15993.
If pmagbbfb_freqs.15993 is only used by pmagbbfb_osc_setup then
annotate pmagbbfb_freqs.15993 with a matching annotation.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
VIDEO: PMAG-BA: Fix section mismatch 2010-07-26T18:08:14+00:00 Ralf Baechle ralf@linux-mips.org 2010-07-26T18:08:14+00:00 9625b51350ccb4db60b743f0d1e5ab696e77ef58 WARNING: drivers/video/built-in.o(.data+0x1e0): Section mismatch in reference fr om the variable pmagbafb_driver to the function .init.text:pmagbafb_probe() The variable pmagbafb_driver references the function __init pmagbafb_probe() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console, Fixing this one triggers 2 more: WARNING: drivers/video/built-in.o(.devinit.text+0xc0): Section mismatch in reference from the function pmagbafb_probe() to the variable .init.data:pmagbafb_fix The function __devinit pmagbafb_probe() references a variable __initdata pmagbafb_fix. If pmagbafb_fix is only used by pmagbafb_probe then annotate pmagbafb_fix with a matching annotation. WARNING: drivers/video/built-in.o(.devinit.text+0x108): Section mismatch in reference from the function pmagbafb_probe() to the variable .init.data:pmagbafb_defined The function __devinit pmagbafb_probe() references a variable __initdata pmagbafb_defined. If pmagbafb_defined is only used by pmagbafb_probe then annotate pmagbafb_defined with a matching annotation. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> 
WARNING: drivers/video/built-in.o(.data+0x1e0): Section mismatch in reference fr
om the variable pmagbafb_driver to the function .init.text:pmagbafb_probe()
The variable pmagbafb_driver references
the function __init pmagbafb_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console,

Fixing this one triggers 2 more:

WARNING: drivers/video/built-in.o(.devinit.text+0xc0): Section mismatch in reference from the function pmagbafb_probe() to the variable .init.data:pmagbafb_fix
The function __devinit pmagbafb_probe() references
a variable __initdata pmagbafb_fix.
If pmagbafb_fix is only used by pmagbafb_probe then
annotate pmagbafb_fix with a matching annotation.

WARNING: drivers/video/built-in.o(.devinit.text+0x108): Section mismatch in reference from the function pmagbafb_probe() to the variable .init.data:pmagbafb_defined
The function __devinit pmagbafb_probe() references
a variable __initdata pmagbafb_defined.
If pmagbafb_defined is only used by pmagbafb_probe then
annotate pmagbafb_defined with a matching annotation.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>