linux-toradex.git/drivers/video, branch v4.4.115

backlight: pwm_bl: Fix overflow condition

2017-12-25T13:22:13+00:00

[ Upstream commit 5d0c49acebc9488e37db95f1d4a55644e545ffe7 ]

This fixes an overflow condition that can happen with high max
brightness and period values in compute_duty_cycle. This fixes it by
using a 64 bit variable for computing the duty cycle.

Signed-off-by: Derek Basehore 
Acked-by: Thierry Reding 
Reviewed-by: Brian Norris 
Signed-off-by: Lee Jones 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: au1200fb: Return an error code if a memory allocation fails

2017-12-20T09:04:57+00:00

[ Upstream commit 8cae353e6b01ac3f18097f631cdbceb5ff28c7f3 ]

'ret' is known to be 0 at this point.
In case of memory allocation error in 'framebuffer_alloc()', return
-ENOMEM instead.

Signed-off-by: Christophe JAILLET 
Cc: Tejun Heo 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: au1200fb: Release some resources if a memory allocation fails

2017-12-20T09:04:57+00:00

[ Upstream commit 451f130602619a17c8883dd0b71b11624faffd51 ]

We should go through the error handling code instead of returning -ENOMEM
directly.

Signed-off-by: Christophe JAILLET 
Cc: Tejun Heo 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

video: udlfb: Fix read EDID timeout

2017-12-20T09:04:57+00:00

[ Upstream commit c98769475575c8a585f5b3952f4b5f90266f699b ]

While usb_control_msg function expects timeout in miliseconds, a value
of HZ is used. Replace it with USB_CTRL_GET_TIMEOUT and also fix error
message which looks like:
udlfb: Read EDID byte 78 failed err ffffff92
as error is either negative errno or number of bytes transferred use %d
format specifier.

Returned EDID is in second byte, so return error when less than two bytes
are received.

Fixes: 18dffdf8913a ("staging: udlfb: enhance EDID and mode handling support")
Signed-off-by: Ladislav Michl 
Cc: Bernie Thompson 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

fbdev: controlfb: Add missing modes to fix out of bounds access

2017-12-20T09:04:57+00:00

[ Upstream commit ac831a379d34109451b3c41a44a20ee10ecb615f ]

Dan's static analysis says:

    drivers/video/fbdev/controlfb.c:560 control_setup()
    error: buffer overflow 'control_mac_modes' 20 <= 21

Indeed, control_mac_modes[] has only 20 elements, while VMODE_MAX is 22,
which may lead to an out of bounds read when parsing vmode commandline
options.

The bug was introduced in v2.4.5.6, when 2 new modes were added to
macmodes.h, but control_mac_modes[] wasn't updated:

https://kernel.opensuse.org/cgit/kernel/diff/include/video/macmodes.h?h=v2.5.2&id=29f279c764808560eaceb88fef36cbc35c529aad

Augment control_mac_modes[] with the two new video modes to fix this.

Reported-by: Dan Carpenter 
Signed-off-by: Geert Uytterhoeven 
Cc: Dan Carpenter 
Cc: Benjamin Herrenschmidt 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

backlight: adp5520: Fix error handling in adp5520_bl_probe()

2017-11-21T08:21:21+00:00

[ Upstream commit 0eb3fba8c68275f0122f65f7316efaaf86448016 ]

If adp5520_bl_setup() fails, sysfs group left unremoved.

By the way, fix overcomplicated assignement of error code.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Acked-by: Michael Hennerich 
Signed-off-by: Lee Jones 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

backlight: lcd: Fix race condition during register

2017-11-21T08:21:21+00:00

[ Upstream commit cc21942bce652d1a92dae85b785378256e1df1f7 ]

Once device_register is called for a device its attributes might be
accessed. As the callbacks of a lcd device's attributes make use of the
lcd_ops, the respective member must be setup before calling
device_register.

Signed-off-by: Uwe Kleine-König 
Signed-off-by: Lee Jones 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: pmag-ba-fb: Remove bad `__init' annotation

2017-11-15T16:13:09+00:00

[ Upstream commit 879e5a0df626f39cbb3c61bb90373e56d67012c4 ]

Fix:

WARNING: drivers/video/fbdev/pmag-ba-fb.o(.text+0x308): Section mismatch in reference from the function pmagbafb_probe() to the function .init.text:pmagbafb_erase_cursor()
The function pmagbafb_probe()
references the function __init pmagbafb_erase_cursor().
This is often because pmagbafb_probe lacks a __init
annotation or the annotation of pmagbafb_erase_cursor is wrong.

-- a fallout from a missed update from commit 9625b51350cc ("VIDEO:
PMAG-BA: Fix section mismatch") and then commit 48c68c4f1b54 ("Drivers:
video: remove __dev* attributes.")

Signed-off-by: Maciej W. Rozycki 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: aty: do not leak uninitialized padding in clk to userspace

2017-10-05T07:41:48+00:00

commit 8e75f7a7a00461ef6d91797a60b606367f6e344d upstream.

'clk' is copied to a userland with padding byte(s) after 'vclk_post_div'
field unitialized, leaking data from the stack. Fix this ensuring all of
'clk' is initialized to zero.

References: https://github.com/torvalds/linux/pull/441
Reported-by: sohu0106 
Signed-off-by: Vladis Dronov 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Greg Kroah-Hartman

video: fbdev: cobalt_lcdfb: Handle return NULL error from devm_ioremap

2017-08-07T02:19:46+00:00

[ Upstream commit 4dcd19bfabaee8f9f4bcf203afba09b98ccbaf76 ]

Here, If devm_ioremap will fail. It will return NULL.
Kernel can run into a NULL-pointer dereference.
This error check will avoid NULL pointer dereference.

Signed-off-by: Arvind Yadav 
Acked-by: Yoichi Yuasa 
Signed-off-by: Bartlomiej Zolnierkiewicz 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman