Commit 2939a792 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fbdev-for-6.17-rc1-2' of... 

Merge tag 'fbdev-for-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull fbdev fixes for 6.17-rc1:

 - Revert a patch which broke VGA console

 - Fix an out-of-bounds access bug which may happen during console
   resizing when a console is mapped to a frame buffer

* tag 'fbdev-for-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
parents 83affacd e4fc307d

drivers/video/console/vgacon.c

+1 −1
Original line number Diff line number Diff line
@@ -1168,7 +1168,7 @@ static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b, 
				     c->vc_screenbuf_size - delta);

			c->vc_origin = vga_vram_end - c->vc_screenbuf_size;

			vga_rolled_over = 0;

		} else if (oldo - delta >= (unsigned long)c->vc_screenbuf)

		} else

			c->vc_origin -= delta;

		c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size;

		scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,

drivers/video/fbdev/core/fbcon.c

+5 −4
Original line number Diff line number Diff line
@@ -837,6 +837,7 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info, 
				   fg_vc->vc_rows);

	}



	if (fg_console != unit)

		update_screen(vc_cons[fg_console].d);

}
@@ -1375,6 +1376,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, 
	struct vc_data *svc;

	struct fbcon_ops *ops = info->fbcon_par;

	int rows, cols;

	unsigned long ret = 0;



	p = &fb_display[unit];
@@ -1425,12 +1427,11 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, 
	rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);

	cols /= vc->vc_font.width;

	rows /= vc->vc_font.height;

	vc_resize(vc, cols, rows);

	ret = vc_resize(vc, cols, rows);



	if (con_is_visible(vc)) {

	if (con_is_visible(vc) && !ret)

		update_screen(vc);

}

}



static __inline__ void ywrap_up(struct vc_data *vc, int count)

{