• Mikulas Patocka's avatar
    framebuffer: fix screen corruption when copying · 6bbdc38d
    Mikulas Patocka authored
    commit 5b789da8 upstream.
    
    The function bitcpy_rev has a bug that may result in screen corruption.
    The bug happens under these conditions:
    * the end of the destination area of a copy operation is aligned on a long
      word boundary
    * the end of the source area is not aligned on a long word boundary
    * we are copying more than one long word
    
    In this case, the variable shift is non-zero and the variable first is
    zero. The statements FB_WRITEL(comp(d0, FB_READL(dst), first), dst) reads
    the last long word of the destination and writes it back unchanged
    (because first is zero). Correctly, we should write the variable d0 to the
    last word of the destination in this case.
    
    This patch fixes the bug by introducing and extra test if first is zero.
    
    The patch also removes the references to fb_memmove in the code that is
    commented out because fb_memmove was removed from framebuffer subsystem.
    Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: default avatarTomi Valkeinen <tomi.valkeinen@ti.com>
    [bwh: Backported to 3.2: adjust context]
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    6bbdc38d
cfbcopyarea.c 11.3 KB