[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <46654A63.6000308@gmail.com>
Date: Tue, 05 Jun 2007 19:34:59 +0800
From: "Antonino A. Daplas" <adaplas@...il.com>
To: Chris Wright <chrisw@...s-sol.org>
CC: Linus Torvalds <torvalds@...ux-foundation.org>, stable@...nel.org,
Andrew Morton <akpm@...ux-foundation.org>,
LKML <linux-kernel@...r.kernel.org>,
Pekka Enberg <penberg@...helsinki.fi>,
Tero Roponen <teanropo@....fi>
Subject: [PATCH] [RESEND] neofb: Fix pseudo_palette array overrun in neofb_setcolreg
The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.
Signed-off-by: Antonino Daplas <adaplas@...il.com>
Acked-by: Tero Roponen <teanropo@....fi>
---
This fixes the following regression/bug reported as follows:
Subject : tty-related oops in latest kernel(s)
References : http://lkml.org/lkml/2007/5/27/104
Submitter : Tero Roponen <teanropo@....fi>
Status : problem is being debugged
According to Tero, this is also reproducible with 2.6.21.3.
(Resending, wrong email address for stable@...nel.org)
Tony
drivers/video/neofb.c | 30 ++++++++++++++++--------------
1 files changed, 16 insertions(+), 14 deletions(-)
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index bd30aba..731d7a5 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -1286,34 +1286,36 @@ static int neofb_setcolreg(u_int regno,
if (regno >= fb->cmap.len || regno > 255)
return -EINVAL;
- switch (fb->var.bits_per_pixel) {
- case 8:
+ if (fb->var.bits_per_pixel <= 8) {
outb(regno, 0x3c8);
outb(red >> 10, 0x3c9);
outb(green >> 10, 0x3c9);
outb(blue >> 10, 0x3c9);
- break;
- case 16:
- ((u32 *) fb->pseudo_palette)[regno] =
+ } else if (regno < 16) {
+ switch (fb->var.bits_per_pixel) {
+ case 16:
+ ((u32 *) fb->pseudo_palette)[regno] =
((red & 0xf800)) | ((green & 0xfc00) >> 5) |
((blue & 0xf800) >> 11);
- break;
- case 24:
- ((u32 *) fb->pseudo_palette)[regno] =
+ break;
+ case 24:
+ ((u32 *) fb->pseudo_palette)[regno] =
((red & 0xff00) << 8) | ((green & 0xff00)) |
((blue & 0xff00) >> 8);
- break;
+ break;
#ifdef NO_32BIT_SUPPORT_YET
- case 32:
- ((u32 *) fb->pseudo_palette)[regno] =
+ case 32:
+ ((u32 *) fb->pseudo_palette)[regno] =
((transp & 0xff00) << 16) | ((red & 0xff00) << 8) |
((green & 0xff00)) | ((blue & 0xff00) >> 8);
- break;
+ break;
#endif
- default:
- return 1;
+ default:
+ return 1;
+ }
}
+
return 0;
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists