Commit c1b4d25b authored by Mikulas Patocka's avatar Mikulas Patocka Committed by Sasha Levin

drm/nouveau/fbcon: fix font width not divisible by 8

[ Upstream commit 28668f43 ]

The patch f045f459 ("drm/nouveau/fbcon: fix out-of-bounds memory accesses")
tries to fix some out of memory accesses. Unfortunatelly, the patch breaks the
display when using fonts with width that is not divisiable by 8.

The monochrome bitmap for each character is stored in memory by lines from top
to bottom. Each line is padded to a full byte.

For example, for 22x11 font, each line is padded to 16 bits, so each
character is consuming 44 bytes total, that is 11 32-bit words. The patch
f045f459 changed the logic to "dsize = ALIGN(image->width *
image->height, 32) >> 5", that is just 8 words - this is incorrect and it
causes display corruption.

This patch adds the necesary padding of lines to 8 bytes.

This patch should be backported to stable kernels where f045f459 was
backported.
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Fixes: f045f459 ("drm/nouveau/fbcon: fix out-of-bounds memory accesses")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent c027bc0c
...@@ -107,11 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) ...@@ -107,11 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
((image->dx + image->width) & 0xffff)); ((image->dx + image->width) & 0xffff));
OUT_RING(chan, bg); OUT_RING(chan, bg);
OUT_RING(chan, fg); OUT_RING(chan, fg);
OUT_RING(chan, (image->height << 16) | image->width); OUT_RING(chan, (image->height << 16) | ALIGN(image->width, 8));
OUT_RING(chan, (image->height << 16) | image->width); OUT_RING(chan, (image->height << 16) | image->width);
OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff)); OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
dsize = ALIGN(image->width * image->height, 32) >> 5; dsize = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
while (dsize) { while (dsize) {
int iter_len = dsize > 128 ? 128 : dsize; int iter_len = dsize > 128 ? 128 : dsize;
......
...@@ -125,7 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) ...@@ -125,7 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
OUT_RING(chan, 0); OUT_RING(chan, 0);
OUT_RING(chan, image->dy); OUT_RING(chan, image->dy);
dwords = ALIGN(image->width * image->height, 32) >> 5; dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
while (dwords) { while (dwords) {
int push = dwords > 2047 ? 2047 : dwords; int push = dwords > 2047 ? 2047 : dwords;
......
...@@ -125,7 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image) ...@@ -125,7 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
OUT_RING (chan, 0); OUT_RING (chan, 0);
OUT_RING (chan, image->dy); OUT_RING (chan, image->dy);
dwords = ALIGN(image->width * image->height, 32) >> 5; dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
while (dwords) { while (dwords) {
int push = dwords > 2047 ? 2047 : dwords; int push = dwords > 2047 ? 2047 : dwords;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment