kernel.git/drivers/video/fbdev/pxafb.c, branch linux-5.4.y

fbdev: pxafb: Fix possible use after free in pxafb_task()

2024-11-08T15:20:38Z

[ Upstream commit 4a6921095eb04a900e0000da83d9475eb958e61e ] In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime. Signed-off-by: Kaixin Wang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin

video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call

2020-08-19T06:16:06Z

[ Upstream commit 499a2c41b954518c372873202d5e7714e22010c4 ] 'dma_alloc_coherent()' must be balanced by a call to 'dma_free_coherent()' not 'dma_free_wc()'. The correct dma_free_ function is already used in the error handling path of the probe function. Fixes: 77e196752bdd ("[ARM] pxafb: allow video memory size to be configurable") Signed-off-by: Christophe JAILLET Cc: Sumit Semwal Cc: Rafael J. Wysocki Cc: Jonathan Corbet Cc: Viresh Kumar Cc: Jani Nikula cc: Mauro Carvalho Chehab Cc: Eric Miao Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/20200429084505.108897-1-christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin

video: pxafb: Remove cpufreq policy notifier

2019-08-26T08:02:02Z

The cpufreq policy notifier's CPUFREQ_ADJUST notification is going to get removed soon. The notifier callback pxafb_freq_policy() isn't doing anything apart from printing a debug message on CPUFREQ_ADJUST notification. There is no point in keeping an otherwise empty callback and registering the notifier. Remove it. Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki

docs: fb: convert docs to ReST and rename to *.rst

2019-06-14T20:21:11Z

The conversion is actually: - add blank lines and identation in order to identify paragraphs; - fix tables markups; - add some lists markups; - mark literal blocks; - adjust title markups. At its new index.rst, let's add a :orphan: while this is not linked to the main index.rst file, in order to avoid build warnings. Also, removed the Maintained by, as requested by Geert. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet

video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data"

2018-12-20T18:13:08Z

'info->modes' got allocated with devm_kcalloc in of_get_pxafb_display. This gives this error message: ./drivers/video/fbdev/pxafb.c:2238:2-7: WARNING: invalid free of devm_ allocated data Fixes: c8f96304ec8b4 ("video: fbdev: pxafb: switch to devm_* API") Cc: stable@kernel.org [v4.19+] Signed-off-by: YueHaibing Reviewed-by: Daniel Mack Cc: Robert Jarzmik Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: pxafb: Add support for lcd-supply regulator

2018-07-24T17:11:26Z

Optionally obtain a lcd-supply regulator during probe and use it in __pxafb_lcd_power() to switch the power supply of LCD panels. This helps boards booted from DT to control such voltages without callbacks. Signed-off-by: Daniel Mack Reviewed-by: Robert Jarzmik Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: pxafb: handle errors from pxafb_init_fbinfo() correctly

2018-07-24T17:11:25Z

pxafb_init_fbinfo() can not only report errors caused by failed allocations but also when the clock can't be found. To fix this, return an error pointer instead of NULL in case of errors, and up-chain the result. Signed-off-by: Daniel Mack Reviewed-by: Robert Jarzmik Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: pxafb: switch to devm_* API

2018-07-24T17:11:25Z

This helps us clean up the probe() and remove() implementations. Signed-off-by: Daniel Mack Reviewed-by: Robert Jarzmik Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: pxafb: clear allocated memory for video modes

2018-07-24T17:11:25Z

When parsing the video modes from DT properties, make sure to zero out memory before using it. This is important because not all fields in the mode struct are explicitly initialized, even though they are used later on. Fixes: 420a488278e86 ("video: fbdev: pxafb: initial devicetree conversion") Reviewed-by: Robert Jarzmik Signed-off-by: Daniel Mack Signed-off-by: Bartlomiej Zolnierkiewicz

video: fbdev: pxafb: match_string() conversion fixup

2018-05-15T16:03:23Z

"unknown" lcd_types[] entry is needed for proper operation of the driver, add it back. Fixes: 6d09dfe70f8f ("video: fbdev: pxafb: Convert to use match_string() helper") Reported-by: Andy Shevchenko Cc: Arvind Yadav Signed-off-by: Bartlomiej Zolnierkiewicz