Commit 6d1a05033bf0bfe236b1c5f425315967d7d684cd
Exists in
smarc-l5.0.0_1.0.0-ga
and in
5 other branches
Merge tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6
Pull fbdev fixes from Florian Tobias Schandinat: - a fix by Paul Cercueil to prevent a possible buffer overflow - a fix by Bruno Prémont to prevent a rare sleep in invalid context - a fix by Julia Lawall for a double free in auo_k190x - a fix by Dan Carpenter to prevent a division by zero in mb862xxfb - a regression fix by Tomi Valkeinen for the SDI output in OMAP - a fix by Grazvydas Ignotas to fix the console colors in OMAP * tag 'fbdev-fixes-for-3.6-1' of git://github.com/schandinat/linux-2.6: OMAPFB: fix framebuffer console colors OMAPDSS: Fix SDI PLL locking video: mb862xxfb: prevent divide by zero bug drivers/video/auo_k190x.c: drop kfree of devm_kzalloc's data fbcon: Fix bit_putcs() call to kmalloc(s, GFP_KERNEL) fbcon: prevent possible buffer overflow.
Showing 6 changed files Side-by-side Diff
drivers/video/auo_k190x.c
| ... | ... | @@ -987,7 +987,6 @@ |
| 987 | 987 | fb_dealloc_cmap(&info->cmap); |
| 988 | 988 | err_cmap: |
| 989 | 989 | fb_deferred_io_cleanup(info); |
| 990 | - kfree(info->fbdefio); | |
| 991 | 990 | err_defio: |
| 992 | 991 | vfree((void *)info->screen_base); |
| 993 | 992 | err_irq: |
| ... | ... | @@ -1022,7 +1021,6 @@ |
| 1022 | 1021 | fb_dealloc_cmap(&info->cmap); |
| 1023 | 1022 | |
| 1024 | 1023 | fb_deferred_io_cleanup(info); |
| 1025 | - kfree(info->fbdefio); | |
| 1026 | 1024 | |
| 1027 | 1025 | vfree((void *)info->screen_base); |
| 1028 | 1026 |
drivers/video/console/bitblit.c
drivers/video/console/fbcon.c
| ... | ... | @@ -449,7 +449,7 @@ |
| 449 | 449 | |
| 450 | 450 | while ((options = strsep(&this_opt, ",")) != NULL) { |
| 451 | 451 | if (!strncmp(options, "font:", 5)) |
| 452 | - strcpy(fontname, options + 5); | |
| 452 | + strlcpy(fontname, options + 5, sizeof(fontname)); | |
| 453 | 453 | |
| 454 | 454 | if (!strncmp(options, "scrollback:", 11)) { |
| 455 | 455 | options += 11; |
drivers/video/mb862xx/mb862xxfbdrv.c
| ... | ... | @@ -328,6 +328,8 @@ |
| 328 | 328 | case MB862XX_L1_SET_CFG: |
| 329 | 329 | if (copy_from_user(l1_cfg, argp, sizeof(*l1_cfg))) |
| 330 | 330 | return -EFAULT; |
| 331 | + if (l1_cfg->dh == 0 || l1_cfg->dw == 0) | |
| 332 | + return -EINVAL; | |
| 331 | 333 | if ((l1_cfg->sw >= l1_cfg->dw) && (l1_cfg->sh >= l1_cfg->dh)) { |
| 332 | 334 | /* downscaling */ |
| 333 | 335 | outreg(cap, GC_CAP_CSC, |
drivers/video/omap2/dss/sdi.c
| ... | ... | @@ -105,6 +105,20 @@ |
| 105 | 105 | |
| 106 | 106 | sdi_config_lcd_manager(dssdev); |
| 107 | 107 | |
| 108 | + /* | |
| 109 | + * LCLK and PCLK divisors are located in shadow registers, and we | |
| 110 | + * normally write them to DISPC registers when enabling the output. | |
| 111 | + * However, SDI uses pck-free as source clock for its PLL, and pck-free | |
| 112 | + * is affected by the divisors. And as we need the PLL before enabling | |
| 113 | + * the output, we need to write the divisors early. | |
| 114 | + * | |
| 115 | + * It seems just writing to the DISPC register is enough, and we don't | |
| 116 | + * need to care about the shadow register mechanism for pck-free. The | |
| 117 | + * exact reason for this is unknown. | |
| 118 | + */ | |
| 119 | + dispc_mgr_set_clock_div(dssdev->manager->id, | |
| 120 | + &sdi.mgr_config.clock_info); | |
| 121 | + | |
| 108 | 122 | dss_sdi_init(dssdev->phy.sdi.datapairs); |
| 109 | 123 | r = dss_sdi_enable(); |
| 110 | 124 | if (r) |
drivers/video/omap2/omapfb/omapfb-main.c