Commit a4819ac1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev 

Pull fbdev fixes from Helge Deller:

 - atyfb: Avoid hard lock up when PLL not initialized (Daniel Palmer)

 - pvr2fb: Fix build error when CONFIG_PVR2_DMA enabled (Florian Fuchs)

 - bitblit: Fix out-of-bounds read in bit_putcs* (Junjie Cao)

 - valkyriefb: Fix reference count leak (Miaoqian Lin)

 - fbcon: Fix slab-use-after-free in fb_mode_is_equal (Quanmin Yan)

 - fb.h: Fix typo in "vertical" (Piyush Choudhary)

* tag 'fbdev-for-6.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: atyfb: Check if pll_ops->init_pll failed
  fbcon: Set fb_display[i]->mode to NULL when the mode is released
  fbdev: bitblit: bound-check glyph index in bit_putcs*
  fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
  fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
  video: fb: Fix typo in comment in fb.h
parents e5763491 7073c7fc

drivers/video/fbdev/aty/atyfb_base.c

+6 −2
Original line number Diff line number Diff line
@@ -2614,8 +2614,12 @@ static int aty_init(struct fb_info *info) 
		pr_cont("\n");

	}

#endif

	if (par->pll_ops->init_pll)

		par->pll_ops->init_pll(info, &par->pll);

	if (par->pll_ops->init_pll) {

		ret = par->pll_ops->init_pll(info, &par->pll);

		if (ret)

			return ret;

	}



	if (par->pll_ops->resume_pll)

		par->pll_ops->resume_pll(info, &par->pll);

drivers/video/fbdev/core/bitblit.c

+12 −4
Original line number Diff line number Diff line
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(struct vc_data *vc, struct fb_info *info, 
				     struct fb_image *image, u8 *buf, u8 *dst)

{

	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;

	unsigned int charcnt = vc->vc_font.charcount;

	u32 idx = vc->vc_font.width >> 3;

	u8 *src;



	while (cnt--) {

		src = vc->vc_font.data + (scr_readw(s++)&

					  charmask)*cellsize;

		u16 ch = scr_readw(s++) & charmask;



		if (ch >= charcnt)

			ch = 0;

		src = vc->vc_font.data + (unsigned int)ch * cellsize;



		if (attr) {

			update_attr(buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(struct vc_data *vc, 
				       u8 *dst)

{

	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;

	unsigned int charcnt = vc->vc_font.charcount;

	u32 shift_low = 0, mod = vc->vc_font.width % 8;

	u32 shift_high = 8;

	u32 idx = vc->vc_font.width >> 3;

	u8 *src;



	while (cnt--) {

		src = vc->vc_font.data + (scr_readw(s++)&

					  charmask)*cellsize;

		u16 ch = scr_readw(s++) & charmask;



		if (ch >= charcnt)

			ch = 0;

		src = vc->vc_font.data + (unsigned int)ch * cellsize;



		if (attr) {

			update_attr(buf, src, attr, vc);

drivers/video/fbdev/core/fbcon.c

+19 −0
Original line number Diff line number Diff line
@@ -2810,6 +2810,25 @@ int fbcon_mode_deleted(struct fb_info *info, 
	return found;

}



static void fbcon_delete_mode(struct fb_videomode *m)

{

	struct fbcon_display *p;



	for (int i = first_fb_vc; i <= last_fb_vc; i++) {

		p = &fb_display[i];

		if (p->mode == m)

			p->mode = NULL;

	}

}



void fbcon_delete_modelist(struct list_head *head)

{

	struct fb_modelist *modelist;



	list_for_each_entry(modelist, head, list)

		fbcon_delete_mode(&modelist->mode);

}



#ifdef CONFIG_VT_HW_CONSOLE_BINDING

static void fbcon_unbind(void)

{

drivers/video/fbdev/core/fbmem.c

+1 −0
Original line number Diff line number Diff line
@@ -544,6 +544,7 @@ static void do_unregister_framebuffer(struct fb_info *fb_info) 
		fb_info->pixmap.addr = NULL;

	}



	fbcon_delete_modelist(&fb_info->modelist);

	fb_destroy_modelist(&fb_info->modelist);

	registered_fb[fb_info->node] = NULL;

	num_registered_fb--;

drivers/video/fbdev/pvr2fb.c

+1 −1
Original line number Diff line number Diff line
@@ -192,7 +192,7 @@ static unsigned long pvr2fb_map; 


#ifdef CONFIG_PVR2_DMA

static unsigned int shdma = PVR2_CASCADE_CHAN;

static unsigned int pvr2dma = ONCHIP_NR_DMA_CHANNELS;

static unsigned int pvr2dma = CONFIG_NR_ONCHIP_DMA_CHANNELS;

#endif



static struct fb_videomode pvr2_modedb[] = {