5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter daniel.vetter@ffwll.ch
[ Upstream commit d443d93864726ad68c0a741d1e7b03934a9af143 ]
No idea why con2fb_acquire_newinfo() initializes much less than fbcon_startup(), but so be it. From a quick look most of the un-initialized stuff should be fairly harmless, but who knows.
Note that the error handling for the con2fb_acquire_newinfo() failure case was very strange: Callers updated con2fb_map to the new value before calling this function, but upon error con2fb_acquire_newinfo reset it to the old value. Since I removed the call to fbcon_release anyway that strange error path was sticking out like a sore thumb, hence I removed it. Which also allows us to remove the oldidx parameter from that function.
v2: Explain what's going on with oldidx and error paths (Sam)
v3: Drop unused variable (0day)
v4: Rebased over bisect fix in previous patch, unchagend end result.
Acked-by: Sam Ravnborg sam@ravnborg.org (v2) Acked-by: Thomas Zimmermann tzimmermann@suse.de Cc: kernel test robot lkp@intel.com Signed-off-by: Daniel Vetter daniel.vetter@intel.com Cc: Daniel Vetter daniel@ffwll.ch Cc: Greg Kroah-Hartman gregkh@linuxfoundation.org Cc: Tetsuo Handa penguin-kernel@I-love.SAKURA.ne.jp Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Claudio Suarez cssk@net-c.es Cc: Du Cheng ducheng2@gmail.com Link: https://patchwork.freedesktop.org/patch/msgid/20220405210335.3434130-12-dani... Stable-dep-of: 17186f1f90d3 ("fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/video/fbdev/core/fbcon.c | 75 +++++++++++++------------------- 1 file changed, 30 insertions(+), 45 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 2a230a6335a81..734b8f3f81b24 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -691,8 +691,18 @@ static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
#endif /* CONFIG_MISC_TILEBLITTING */
+static void fbcon_release(struct fb_info *info) +{ + if (info->fbops->fb_release) + info->fbops->fb_release(info, 0); + + module_put(info->fbops->owner); +} + static int fbcon_open(struct fb_info *info) { + struct fbcon_ops *ops; + if (!try_module_get(info->fbops->owner)) return -ENODEV;
@@ -702,48 +712,31 @@ static int fbcon_open(struct fb_info *info) return -ENODEV; }
- return 0; -} + ops = kzalloc(sizeof(struct fbcon_ops), GFP_KERNEL); + if (!ops) { + fbcon_release(info); + return -ENOMEM; + }
-static void fbcon_release(struct fb_info *info) -{ - if (info->fbops->fb_release) - info->fbops->fb_release(info, 0); + INIT_DELAYED_WORK(&ops->cursor_work, fb_flashcursor); + ops->info = info; + info->fbcon_par = ops; + ops->cur_blink_jiffies = HZ / 5;
- module_put(info->fbops->owner); + return 0; }
static int con2fb_acquire_newinfo(struct vc_data *vc, struct fb_info *info, - int unit, int oldidx) + int unit) { - struct fbcon_ops *ops = NULL; int err;
err = fbcon_open(info); if (err) return err;
- if (!err) { - ops = kzalloc(sizeof(struct fbcon_ops), GFP_KERNEL); - if (!ops) - err = -ENOMEM; - } - - if (!err) { - INIT_DELAYED_WORK(&ops->cursor_work, fb_flashcursor); - - ops->cur_blink_jiffies = HZ / 5; - ops->info = info; - info->fbcon_par = ops; - - if (vc) - set_blitting_type(vc, info); - } - - if (err) { - con2fb_map[unit] = oldidx; - fbcon_release(info); - } + if (vc) + set_blitting_type(vc, info);
return err; } @@ -854,9 +847,11 @@ static int set_con2fb_map(int unit, int newidx, int user)
found = search_fb_in_map(newidx);
- con2fb_map[unit] = newidx; - if (!err && !found) - err = con2fb_acquire_newinfo(vc, info, unit, oldidx); + if (!err && !found) { + err = con2fb_acquire_newinfo(vc, info, unit); + if (!err) + con2fb_map[unit] = newidx; + }
/* * If old fb is not mapped to any of the consoles, @@ -956,20 +951,10 @@ static const char *fbcon_startup(void) if (fbcon_open(info)) return NULL;
- ops = kzalloc(sizeof(struct fbcon_ops), GFP_KERNEL); - if (!ops) { - fbcon_release(info); - return NULL; - } - - INIT_DELAYED_WORK(&ops->cursor_work, fb_flashcursor); - + ops = info->fbcon_par; ops->currcon = -1; ops->graphics = 1; ops->cur_rotate = -1; - ops->cur_blink_jiffies = HZ / 5; - ops->info = info; - info->fbcon_par = ops;
p->con_rotate = initial_rotation; if (p->con_rotate == -1) @@ -1037,7 +1022,7 @@ static void fbcon_init(struct vc_data *vc, int init) return;
if (!info->fbcon_par) - con2fb_acquire_newinfo(vc, info, vc->vc_num, -1); + con2fb_acquire_newinfo(vc, info, vc->vc_num);
/* If we are not the first console on this fb, copy the font from that console */