diff options
| author | Tingjie Zhong <catme0w@live.cn> | 2026-10-20 10:46:57 -0600 |
|---|---|---|
| committer | Helge Deller <deller@gmx.de> | 2026-10-20 22:27:07 +0200 |
| commit | 06fccf840640d8f6b0e08a1756f8d2f0435b4cbe (patch) | |
| tree | 5b63079f59219334a8e780df28adc4a1e7a6d6f9 /include/linux | |
| parent | 54ddfe9a7eef0d207d72338ea009278998f87668 (diff) | |
fbdev: bitblit: Fix glyph clipping when fbcon pans
Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
so after the first pan most new text is not drawn until the next full
redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.
Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
use as the drawing area height. When fbcon does not pan, GETVYRES()
returns var.yres, keeping the existing bound. When fbcon pans, it
returns var.yres_virtual, which the framebuffer memory must cover
anyway for panning to work.
Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds")
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Closes: https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@suse.de/
Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: stable@vger.kernel.org
Signed-off-by: Tingjie Zhong <catme0w@live.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions