archive/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-08-15 14:11:42 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fbdev fixes for 6.17-rc1:

Browse source 
- Revert a patch which broke VGA console.
 - Fix an out-of-bounds access bug which may happen during console
    resizing when a console is mapped to a frame buffer.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaJRydwAKCRD3ErUQojoP
 Xx6JAP929Q1PbZAbYSc/99dkxmKmfQk7/g7daI5Rl9YHWvvALgD/WFM/kWWIcFFe
 T4Z8+v3fa3+vez8w4jH5k9/IY2YU4w8=
 =Zr8P
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-for-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull fbdev fixes for 6.17-rc1:

 - Revert a patch which broke VGA console

 - Fix an out-of-bounds access bug which may happen during console
   resizing when a console is mapped to a frame buffer

* tag 'fbdev-for-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
This commit is contained in:
Linus Torvalds 2025-08-08 06:43:20 +03:00
commit 2939a792c4
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/video/console/vgacon.c
View file

@ -1168,7 +1168,7 @@ static bool vgacon_scroll(struct vc_data *c, unsigned int t, unsigned int b,
c->vc_screenbuf_size - delta);
c->vc_origin = vga_vram_end - c->vc_screenbuf_size;
vga_rolled_over = 0;
} else if (oldo - delta >= (unsigned long)c->vc_screenbuf)
} else
c->vc_origin -= delta;
c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size;
scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,

9
drivers/video/fbdev/core/fbcon.c
View file

@ -837,7 +837,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info,
fg_vc->vc_rows);
}
update_screen(vc_cons[fg_console].d);
if (fg_console != unit)
update_screen(vc_cons[fg_console].d);
}
/**
@ -1375,6 +1376,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
struct vc_data *svc;
struct fbcon_ops *ops = info->fbcon_par;
int rows, cols;
unsigned long ret = 0;
p = &fb_display[unit];
@ -1425,11 +1427,10 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,
rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
vc_resize(vc, cols, rows);
ret = vc_resize(vc, cols, rows);
if (con_is_visible(vc)) {
if (con_is_visible(vc) && !ret)
update_screen(vc);
}
}
static __inline__ void ywrap_up(struct vc_data *vc, int count)