1. 31 Mar, 2020 1 commit
    • Qiujun Huang's avatar
      fbcon: fix null-ptr-deref in fbcon_switch · b139f8b0
      Qiujun Huang authored
      Set logo_shown to FBCON_LOGO_CANSHOW when the vc was deallocated.
      
      syzkaller report: https://lkml.org/lkml/2020/3/27/403
      general protection fault, probably for non-canonical address
      0xdffffc000000006c: 0000 [#1] SMP KASAN
      KASAN: null-ptr-deref in range [0x0000000000000360-0x0000000000000367]
      RIP: 0010:fbcon_switch+0x28f/0x1740
      drivers/video/fbdev/core/fbcon.c:2260
      
      Call Trace:
      redraw_screen+0x2a8/0x770 drivers/tty/vt/vt.c:1008
      vc_do_resize+0xfe7/0x1360 drivers/tty/vt/vt.c:1295
      fbcon_init+0x1221/0x1ab0 drivers/video/fbdev/core/fbcon.c:1219
      visual_init+0x305/0x5c0 drivers/tty/vt/vt.c:1062
      do_bind_con_driver+0x536/0x890 drivers/tty/vt/vt.c:3542
      do_take_over_console+0x453/0x5b0 drivers/tty/vt/vt.c:4122
      do_fbcon_takeover+0x10b/0x210 drivers/video/fbdev/core/fbcon.c:588
      fbcon_fb_registered+0x26b/0x340 drivers/video/fbdev/core/fbcon.c:3259
      do_register_framebuffer drivers/video/fbdev/core/fbmem.c:1664 [inline]
      register_framebuffer+0x56e/0x980 drivers/video/fbdev/core/fbmem.c:1832
      dlfb_usb_probe.cold+0x1743/0x1ba3 drivers/video/fbdev/udlfb.c:1735
      usb_probe_interface+0x310/0x800 drivers/usb/core/driver.c:374
      
      accessing vc_cons[logo_shown].d->vc_top causes the bug.
      
      Reported-by: syzbot+732528bae351682f1f27@syzkaller.appspotmail.com
      Signed-off-by: default avatarQiujun Huang <hqjagain@gmail.com>
      Acked-by: default avatarSam Ravnborg <sam@ravnborg.org>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200329085647.25133-1-hqjagain@gmail.com
      b139f8b0
  2. 30 Mar, 2020 2 commits
  3. 27 Mar, 2020 1 commit
  4. 26 Mar, 2020 1 commit
    • Hans de Goede's avatar
      drm/vboxvideo: Add missing remove_conflicting_pci_framebuffers call, v2 · a65a97b4
      Hans de Goede authored
      The vboxvideo driver is missing a call to remove conflicting framebuffers.
      
      Surprisingly, when using legacy BIOS booting this does not really cause
      any issues. But when using UEFI to boot the VM then plymouth will draw
      on both the efifb /dev/fb0 and /dev/drm/card0 (which has registered
      /dev/fb1 as fbdev emulation).
      
      VirtualBox will actual display the output of both devices (I guess it is
      showing whatever was drawn last), this causes weird artifacts because of
      pitch issues in the efifb when the VM window is not sized at 1024x768
      (the window will resize to its last size once the vboxvideo driver loads,
      changing the pitch).
      
      Adding the missing drm_fb_helper_remove_conflicting_pci_framebuffers()
      call fixes this.
      
      Changes in v2:
      -Make the drm_fb_helper_remove_conflicting_pci_framebuffers() call one of
       the first things we do in our probe() method
      
      Cc: stable@vger.kernel.org
      Fixes: 2695eae1 ("drm/vboxvideo: Switch to generic fbdev emulation")
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200325144310.36779-1-hdegoede@redhat.com
      a65a97b4
  5. 25 Mar, 2020 3 commits
  6. 16 Mar, 2020 7 commits
  7. 14 Mar, 2020 2 commits
  8. 13 Mar, 2020 2 commits
  9. 11 Mar, 2020 16 commits
  10. 10 Mar, 2020 5 commits