Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
so after the first pan most new text is not drawn until the next full
redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.
Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
use as the drawing area height. When fbcon does not pan, GETVYRES()
returns var.yres, keeping the existing bound. When fbcon pans, it
returns var.yres_virtual, which the framebuffer memory must cover
anyway for panning to work.
Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
vmalloc-out-of-bounds")
Reported-by: Thomas Zimmermann <[email protected]>
Closes:
https://lore.kernel.org/linux-fbdev/[email protected]/
Tested-by: Thomas Zimmermann <[email protected]>
Cc: [email protected]
Signed-off-by: Tingjie Zhong <[email protected]>
---
v2:
- Sign off with my legal name
- Add Reported-by, Closes and Tested-by from Thomas
v1:
https://lore.kernel.org/linux-fbdev/tyyp301mb1525c03fe71d47908263ebfcf6...@tyyp301mb1525.jpnp301.prod.outlook.com/
drivers/video/fbdev/core/bitblit.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/core/bitblit.c
b/drivers/video/fbdev/core/bitblit.c
index 39f44258d793..323a9e79a684 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -18,6 +18,7 @@
#include <linux/console.h>
#include <asm/types.h>
#include "fbcon.h"
+#include "fbcon_rotate.h"
/*
* Accelerated handlers.
@@ -150,7 +151,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info
*info,
const unsigned short *s, int count, int yy, int xx,
int fg, int bg)
{
+ struct fbcon_par *par = info->fbcon_par;
struct fb_image image;
+ u32 vyres = GETVYRES(par->p, info);
u32 width = DIV_ROUND_UP(vc->vc_font.width, 8);
u32 cellsize = width * vc->vc_font.height;
u32 maxcnt = info->pixmap.size/cellsize;
@@ -167,10 +170,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info
*info,
image.height = vc->vc_font.height;
image.depth = 1;
- if (image.dy >= info->var.yres)
+ if (image.dy >= vyres)
return;
- image.height = min(image.height, info->var.yres - image.dy);
+ image.height = min(image.height, vyres - image.dy);
if (attribute) {
buf = kmalloc(cellsize, GFP_ATOMIC);
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
--
2.56.0
