linux-kernel - [PATCH 3.16 69/99] fbdev: fbmem: behave better with small rotated displays and many CPUs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lsq.1554212307.78862759@decadent.org.uk>
Date:   Tue, 02 Apr 2019 14:38:27 +0100
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org, Denis Kirjanov <kda@...ux-powerpc.org>,
        "Peter Rosin" <peda@...ntia.se>,
        "Tomi Valkeinen" <tomi.valkeinen@...com>,
        "Geert Uytterhoeven" <geert+renesas@...der.be>,
        "Geoff Levand" <geoff@...radead.org>,
        "James Simmons" <jsimmons@...rs.sf.net>,
        "Bartlomiej Zolnierkiewicz" <b.zolnierkie@...sung.com>,
        "Fabian Frederick" <ffrederick@...rs.sourceforge.net>
Subject: [PATCH 3.16 69/99] fbdev: fbmem: behave better with small rotated
 displays and many CPUs

3.16.65-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Rosin <peda@...ntia.se>

commit f75df8d4b4fabfad7e3cba2debfad12741c6fde7 upstream.

Blitting an image with "negative" offsets is not working since there
is no clipping. It hopefully just crashes. For the bootup logo, there
is protection so that blitting does not happen as the image is drawn
further and further to the right (ROTATE_UR) or further and further
down (ROTATE_CW). There is however no protection when drawing in the
opposite directions (ROTATE_UD and ROTATE_CCW).

Add back this protection.

The regression is 20-odd years old but the mindless warning-killing
mentality displayed in commit 34bdb666f4b2 ("fbdev: fbmem: remove
positive test on unsigned values") is also to blame, methinks.

Fixes: 448d479747b8 ("fbdev: fb_do_show_logo() updates")
Signed-off-by: Peter Rosin <peda@...ntia.se>
Cc: Tomi Valkeinen <tomi.valkeinen@...com>
Cc: Fabian Frederick <ffrederick@...rs.sourceforge.net>
Cc: Geert Uytterhoeven <geert+renesas@...der.be>
cc: Geoff Levand <geoff@...radead.org>
Cc: James Simmons <jsimmons@...rs.sf.net>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/video/fbdev/core/fbmem.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -433,7 +433,9 @@ static void fb_do_show_logo(struct fb_in
 			image->dx += image->width + 8;
 		}
 	} else if (rotate == FB_ROTATE_UD) {
-		for (x = 0; x < num; x++) {
+		u32 dx = image->dx;
+
+		for (x = 0; x < num && image->dx <= dx; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dx -= image->width + 8;
 		}
@@ -445,7 +447,9 @@ static void fb_do_show_logo(struct fb_in
 			image->dy += image->height + 8;
 		}
 	} else if (rotate == FB_ROTATE_CCW) {
-		for (x = 0; x < num; x++) {
+		u32 dy = image->dy;
+
+		for (x = 0; x < num && image->dy <= dy; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dy -= image->height + 8;
 		}