From 2e1e5979bbe07f1a72276fd486abb3e693364628 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: 68328fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/68328fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/68328fb.c b/drivers/video/68328fb.c index 75a39eab70c..a425d65d5ba 100644 --- a/drivers/video/68328fb.c +++ b/drivers/video/68328fb.c @@ -378,8 +378,8 @@ static int mc68x328fb_pan_display(struct fb_var_screeninfo *var, || var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual || - var->yoffset + var->yres > info->var.yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; } info->var.xoffset = var->xoffset; -- cgit v1.2.3-70-g09d2 From 3846e93a65b1a127f59203606c0e92dd22f08782 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 13:43:53 +0200 Subject: acornfb: Dont BUG() on invalid pan parameters The driver currently BUG()s if the pan parameters passed directly from userspace are invalid. Return -EINVAL instead. Signed-off-by: Laurent Pinchart --- drivers/video/acornfb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/video/acornfb.c b/drivers/video/acornfb.c index 6183a57eb69..3bacc129054 100644 --- a/drivers/video/acornfb.c +++ b/drivers/video/acornfb.c @@ -852,7 +852,8 @@ acornfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) if (!(var->vmode & FB_VMODE_YWRAP)) y_bottom += var->yres; - BUG_ON(y_bottom > var->yres_virtual); + if (y_bottom > var->yres_virtual) + return -EINVAL; acornfb_update_dma(info, var); -- cgit v1.2.3-70-g09d2 From 2970840c034838d717126fbec0b38029c7f04852 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: acornfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/acornfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/acornfb.c b/drivers/video/acornfb.c index 3bacc129054..b303f171506 100644 --- a/drivers/video/acornfb.c +++ b/drivers/video/acornfb.c @@ -850,9 +850,9 @@ acornfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) u_int y_bottom = var->yoffset; if (!(var->vmode & FB_VMODE_YWRAP)) - y_bottom += var->yres; + y_bottom += info->var.yres; - if (y_bottom > var->yres_virtual) + if (y_bottom > info->var.yres_virtual) return -EINVAL; acornfb_update_dma(info, var); -- cgit v1.2.3-70-g09d2 From a35a9b79dd44b36b688c493610dfbbdb42aff136 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: arkfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/arkfb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'drivers') diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c index 8686429cbdf..555dd4c64f5 100644 --- a/drivers/video/arkfb.c +++ b/drivers/video/arkfb.c @@ -908,13 +908,14 @@ static int arkfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info unsigned int offset; /* Calculate the offset */ - if (var->bits_per_pixel == 0) { - offset = (var->yoffset / 16) * (var->xres_virtual / 2) + (var->xoffset / 2); + if (info->var.bits_per_pixel == 0) { + offset = (var->yoffset / 16) * (info->var.xres_virtual / 2) + + (var->xoffset / 2); offset = offset >> 2; } else { offset = (var->yoffset * info->fix.line_length) + - (var->xoffset * var->bits_per_pixel / 8); - offset = offset >> ((var->bits_per_pixel == 4) ? 2 : 3); + (var->xoffset * info->var.bits_per_pixel / 8); + offset = offset >> ((info->var.bits_per_pixel == 4) ? 2 : 3); } /* Set the offset */ -- cgit v1.2.3-70-g09d2 From b3e9c12949c1e66f3190e430ad096e53df4e1328 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: atmel_lcdfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart Acked-by: Nicolas Ferre Reviewed-by: Wolfram Sang --- drivers/video/atmel_lcdfb.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'drivers') diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c index 817ab60f753..244d55b7c0a 100644 --- a/drivers/video/atmel_lcdfb.c +++ b/drivers/video/atmel_lcdfb.c @@ -39,7 +39,8 @@ | FBINFO_HWACCEL_YPAN) static inline void atmel_lcdfb_update_dma2d(struct atmel_lcdfb_info *sinfo, - struct fb_var_screeninfo *var) + struct fb_var_screeninfo *var, + struct fb_info *info) { } @@ -50,14 +51,16 @@ static inline void atmel_lcdfb_update_dma2d(struct atmel_lcdfb_info *sinfo, | FBINFO_HWACCEL_YPAN) static void atmel_lcdfb_update_dma2d(struct atmel_lcdfb_info *sinfo, - struct fb_var_screeninfo *var) + struct fb_var_screeninfo *var, + struct fb_info *info) { u32 dma2dcfg; u32 pixeloff; - pixeloff = (var->xoffset * var->bits_per_pixel) & 0x1f; + pixeloff = (var->xoffset * info->var.bits_per_pixel) & 0x1f; - dma2dcfg = ((var->xres_virtual - var->xres) * var->bits_per_pixel) / 8; + dma2dcfg = (info->var.xres_virtual - info->var.xres) + * info->var.bits_per_pixel / 8; dma2dcfg |= pixeloff << ATMEL_LCDC_PIXELOFF_OFFSET; lcdc_writel(sinfo, ATMEL_LCDC_DMA2DCFG, dma2dcfg); @@ -249,14 +252,14 @@ static void atmel_lcdfb_update_dma(struct fb_info *info, unsigned long dma_addr; dma_addr = (fix->smem_start + var->yoffset * fix->line_length - + var->xoffset * var->bits_per_pixel / 8); + + var->xoffset * info->var.bits_per_pixel / 8); dma_addr &= ~3UL; /* Set framebuffer DMA base address and pixel offset */ lcdc_writel(sinfo, ATMEL_LCDC_DMABADDR1, dma_addr); - atmel_lcdfb_update_dma2d(sinfo, var); + atmel_lcdfb_update_dma2d(sinfo, var, info); } static inline void atmel_lcdfb_free_video_memory(struct atmel_lcdfb_info *sinfo) -- cgit v1.2.3-70-g09d2 From 0e03f856d2383a5428cf6de516b73d2b40841ced Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: radeonfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Laurent Pinchart --- drivers/video/aty/radeon_base.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'drivers') diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c index 32f8cf6200a..150684882ef 100644 --- a/drivers/video/aty/radeon_base.c +++ b/drivers/video/aty/radeon_base.c @@ -845,16 +845,16 @@ static int radeonfb_pan_display (struct fb_var_screeninfo *var, { struct radeonfb_info *rinfo = info->par; - if ((var->xoffset + var->xres > var->xres_virtual) - || (var->yoffset + var->yres > var->yres_virtual)) - return -EINVAL; + if ((var->xoffset + info->var.xres > info->var.xres_virtual) + || (var->yoffset + info->var.yres > info->var.yres_virtual)) + return -EINVAL; if (rinfo->asleep) return 0; radeon_fifo_wait(2); - OUTREG(CRTC_OFFSET, ((var->yoffset * var->xres_virtual + var->xoffset) - * var->bits_per_pixel / 8) & ~7); + OUTREG(CRTC_OFFSET, (var->yoffset * info->fix.line_length + + var->xoffset * info->var.bits_per_pixel / 8) & ~7); return 0; } -- cgit v1.2.3-70-g09d2 From 8b76c6827991858a52841b6c20fea91a12499d6f Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: fbdev: da8xx: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/da8xx-fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c index fcdac872522..8d4e4ebd997 100644 --- a/drivers/video/da8xx-fb.c +++ b/drivers/video/da8xx-fb.c @@ -877,8 +877,8 @@ static int da8xx_pan_display(struct fb_var_screeninfo *var, start = fix->smem_start + new_var.yoffset * fix->line_length + - new_var.xoffset * var->bits_per_pixel / 8; - end = start + var->yres * fix->line_length - 1; + new_var.xoffset * fbi->var.bits_per_pixel / 8; + end = start + fbi->var.yres * fix->line_length - 1; par->dma_start = start; par->dma_end = end; } -- cgit v1.2.3-70-g09d2 From 465cb7e700e8564fd2d76d5c7f3703eb07659617 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: fbdev: unicore32: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart Tested-by: Guan Xuetao Acked-by: Guan Xuetao --- drivers/video/fb-puv3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/fb-puv3.c b/drivers/video/fb-puv3.c index 27f2c57e06e..60a787fa32c 100644 --- a/drivers/video/fb-puv3.c +++ b/drivers/video/fb-puv3.c @@ -624,8 +624,8 @@ static int unifb_pan_display(struct fb_var_screeninfo *var, || var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual || - var->yoffset + var->yres > info->var.yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; } info->var.xoffset = var->xoffset; -- cgit v1.2.3-70-g09d2 From d8344e090c5adff3290925cbb040d20133b7f586 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: g364fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/g364fb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/g364fb.c b/drivers/video/g364fb.c index d662317d85e..223896cc5f7 100644 --- a/drivers/video/g364fb.c +++ b/drivers/video/g364fb.c @@ -149,10 +149,11 @@ int g364fb_cursor(struct fb_info *info, struct fb_cursor *cursor) static int g364fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) { - if (var->xoffset || var->yoffset + var->yres > var->yres_virtual) + if (var->xoffset || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; - *(unsigned int *) TOP_REG = var->yoffset * var->xres; + *(unsigned int *) TOP_REG = var->yoffset * info->var.xres; return 0; } -- cgit v1.2.3-70-g09d2 From 1d4b695fa32b707b40fe2dab6a21a39bd91f4615 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: gxt4500: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/gxt4500.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c index 896e53dea90..0fad23f810a 100644 --- a/drivers/video/gxt4500.c +++ b/drivers/video/gxt4500.c @@ -543,8 +543,8 @@ static int gxt4500_pan_display(struct fb_var_screeninfo *var, if (var->xoffset & 7) return -EINVAL; - if (var->xoffset + var->xres > var->xres_virtual || - var->yoffset + var->yres > var->yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; writereg(par, REFRESH_START, (var->xoffset << 16) | var->yoffset); -- cgit v1.2.3-70-g09d2 From 7b116e54920ff9b8bf082fb3c371187ed075ac38 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: hgafb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/hgafb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/hgafb.c b/drivers/video/hgafb.c index 4052718eefa..4394389caf6 100644 --- a/drivers/video/hgafb.c +++ b/drivers/video/hgafb.c @@ -422,8 +422,8 @@ static int hgafb_pan_display(struct fb_var_screeninfo *var, var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual - || var->yoffset + var->yres > info->var.yres_virtual + if (var->xoffset + info->var.xres > info->var.xres_virtual + || var->yoffset + info->var.yres > info->var.yres_virtual || var->yoffset % 8) return -EINVAL; } -- cgit v1.2.3-70-g09d2 From 09a9168d4c3f3bf3b0f9306966379df500f201d2 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: imsttfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/imsttfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/video/imsttfb.c b/drivers/video/imsttfb.c index efb2c10656b..8149356471e 100644 --- a/drivers/video/imsttfb.c +++ b/drivers/video/imsttfb.c @@ -749,7 +749,7 @@ set_offset (struct fb_var_screeninfo *var, struct fb_info *info) { struct imstt_par *par = info->par; __u32 off = var->yoffset * (info->fix.line_length >> 3) - + ((var->xoffset * (var->bits_per_pixel >> 3)) >> 3); + + ((var->xoffset * (info->var.bits_per_pixel >> 3)) >> 3); write_reg_le32(par->dc_regs, SSR, off); } -- cgit v1.2.3-70-g09d2 From f5b9cc6a66feee205609ef98b1f5a51168c26b74 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: intelfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/intelfb/intelfbhw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers') diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/intelfb/intelfbhw.c index 38065cf94ac..fbad61da359 100644 --- a/drivers/video/intelfb/intelfbhw.c +++ b/drivers/video/intelfb/intelfbhw.c @@ -390,12 +390,12 @@ int intelfbhw_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) xoffset = ROUND_DOWN_TO(var->xoffset, 8); yoffset = var->yoffset; - if ((xoffset + var->xres > var->xres_virtual) || - (yoffset + var->yres > var->yres_virtual)) + if ((xoffset + info->var.xres > info->var.xres_virtual) || + (yoffset + info->var.yres > info->var.yres_virtual)) return -EINVAL; offset = (yoffset * dinfo->pitch) + - (xoffset * var->bits_per_pixel) / 8; + (xoffset * info->var.bits_per_pixel) / 8; offset += dinfo->fb.offset << 12; -- cgit v1.2.3-70-g09d2 From 23dc8b1c07f75427510d56fa7c263dd1371ec2e4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: mb862xxfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/mb862xx/mb862xxfbdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/video/mb862xx/mb862xxfbdrv.c b/drivers/video/mb862xx/mb862xxfbdrv.c index ee1de3e26de..7a1f2773cf3 100644 --- a/drivers/video/mb862xx/mb862xxfbdrv.c +++ b/drivers/video/mb862xx/mb862xxfbdrv.c @@ -278,7 +278,7 @@ static int mb862xxfb_pan(struct fb_var_screeninfo *var, reg = pack(var->yoffset, var->xoffset); outreg(disp, GC_L0WY_L0WX, reg); - reg = pack(var->yres_virtual, var->xres_virtual); + reg = pack(info->var.yres_virtual, info->var.xres_virtual); outreg(disp, GC_L0WH_L0WW, reg); return 0; } -- cgit v1.2.3-70-g09d2 From 9f1b3ebbce04dc61986a1b3b41b0f1b1a77a5cc4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: mx3fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Laurent Pinchart Tested-by: Guennadi Liakhovetski --- drivers/video/mx3fb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers') diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c index 7e3a490e8d7..bd768588cf1 100644 --- a/drivers/video/mx3fb.c +++ b/drivers/video/mx3fb.c @@ -1062,15 +1062,15 @@ static int mx3fb_pan_display(struct fb_var_screeninfo *var, y_bottom = var->yoffset; if (!(var->vmode & FB_VMODE_YWRAP)) - y_bottom += var->yres; + y_bottom += fbi->var.yres; if (y_bottom > fbi->var.yres_virtual) return -EINVAL; mutex_lock(&mx3_fbi->mutex); - offset = (var->yoffset * var->xres_virtual + var->xoffset) * - (var->bits_per_pixel / 8); + offset = var->yoffset * fbi->fix.line_length + + var->xoffset * (fbi->var.bits_per_pixel / 8); base = fbi->fix.smem_start + offset; dev_dbg(fbi->device, "Updating SDC BG buf %d address=0x%08lX\n", -- cgit v1.2.3-70-g09d2 From 4935ebf43cedadcaffa56cd59449c8b6dda6d507 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: neofb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/neofb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c index 588527a254c..feea7b1dc38 100644 --- a/drivers/video/neofb.c +++ b/drivers/video/neofb.c @@ -1185,8 +1185,8 @@ static int neofb_pan_display(struct fb_var_screeninfo *var, DBG("neofb_update_start"); - Base = (var->yoffset * var->xres_virtual + var->xoffset) >> 2; - Base *= (var->bits_per_pixel + 7) / 8; + Base = (var->yoffset * info->var.xres_virtual + var->xoffset) >> 2; + Base *= (info->var.bits_per_pixel + 7) / 8; neoUnlock(); -- cgit v1.2.3-70-g09d2 From 3bb8c31dea4f4fe41c954e1a02ac3cdd8ee6747f Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: pm2fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/pm2fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/pm2fb.c b/drivers/video/pm2fb.c index 27f93aab6dd..f4f8ce802d0 100644 --- a/drivers/video/pm2fb.c +++ b/drivers/video/pm2fb.c @@ -973,8 +973,8 @@ static int pm2fb_pan_display(struct fb_var_screeninfo *var, { struct pm2fb_par *p = info->par; u32 base; - u32 depth = (var->bits_per_pixel + 7) & ~7; - u32 xres = (var->xres + 31) & ~31; + u32 depth = (info->var.bits_per_pixel + 7) & ~7; + u32 xres = (info->var.xres + 31) & ~31; depth = (depth > 32) ? 32 : depth; base = to3264(var->yoffset * xres + var->xoffset, depth, 1); -- cgit v1.2.3-70-g09d2 From 01cba946e38eaa7071fd6fc756eedeecfcec3dd6 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: pm3fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/pm3fb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/pm3fb.c b/drivers/video/pm3fb.c index 6666f45a2f8..8221b5b42da 100644 --- a/drivers/video/pm3fb.c +++ b/drivers/video/pm3fb.c @@ -1147,9 +1147,9 @@ static int pm3fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) { struct pm3_par *par = info->par; - const u32 xres = (var->xres + 31) & ~31; + const u32 xres = (info->var.xres + 31) & ~31; - par->base = pm3fb_shift_bpp(var->bits_per_pixel, + par->base = pm3fb_shift_bpp(info->var.bits_per_pixel, (var->yoffset * xres) + var->xoffset); PM3_WAIT(par, 1); -- cgit v1.2.3-70-g09d2 From d8e7a74bf1f1c3d8235e1d939d3e1e96da94ed82 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: s3c-fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart Acked-by: Jingoo Han --- drivers/video/s3c-fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c index 4aecf213c9b..fd9f20df912 100644 --- a/drivers/video/s3c-fb.c +++ b/drivers/video/s3c-fb.c @@ -883,7 +883,7 @@ static int s3c_fb_pan_display(struct fb_var_screeninfo *var, } } /* Offset in bytes to the end of the displayed area */ - end_boff = start_boff + var->yres * info->fix.line_length; + end_boff = start_boff + info->var.yres * info->fix.line_length; /* Temporarily turn off per-vsync update from shadow registers until * both start and end addresses are updated to prevent corruption */ -- cgit v1.2.3-70-g09d2 From 305e0e4dbcd038625786a40e9fa801ba5b18b2a2 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: s3fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/s3fb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'drivers') diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c index 4ca5d0c8fe8..0f9af1aa507 100644 --- a/drivers/video/s3fb.c +++ b/drivers/video/s3fb.c @@ -1019,12 +1019,13 @@ static int s3fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) unsigned int offset; /* Calculate the offset */ - if (var->bits_per_pixel == 0) { - offset = (var->yoffset / 16) * (var->xres_virtual / 2) + (var->xoffset / 2); + if (info->var.bits_per_pixel == 0) { + offset = (var->yoffset / 16) * (info->var.xres_virtual / 2) + + (var->xoffset / 2); offset = offset >> 2; } else { offset = (var->yoffset * info->fix.line_length) + - (var->xoffset * var->bits_per_pixel / 8); + (var->xoffset * info->var.bits_per_pixel / 8); offset = offset >> 2; } -- cgit v1.2.3-70-g09d2 From e1599cf8c7ab93cb4bbd67516f5c989211335df1 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: savagefb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Laurent Pinchart Reviewed-by: Tormod Volden --- drivers/video/savage/savagefb_driver.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) (limited to 'drivers') diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c index 4de541ca9c5..beb495044b2 100644 --- a/drivers/video/savage/savagefb_driver.c +++ b/drivers/video/savage/savagefb_driver.c @@ -1477,15 +1477,9 @@ static void savagefb_set_par_int(struct savagefb_par *par, struct savage_reg *r vgaHWProtect(par, 0); } -static void savagefb_update_start(struct savagefb_par *par, - struct fb_var_screeninfo *var) +static void savagefb_update_start(struct savagefb_par *par, int base) { - int base; - - base = ((var->yoffset * var->xres_virtual + (var->xoffset & ~1)) - * ((var->bits_per_pixel+7) / 8)) >> 2; - - /* now program the start address registers */ + /* program the start address registers */ vga_out16(0x3d4, (base & 0x00ff00) | 0x0c, par); vga_out16(0x3d4, ((base & 0x00ff) << 8) | 0x0d, par); vga_out8(0x3d4, 0x69, par); @@ -1550,8 +1544,12 @@ static int savagefb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) { struct savagefb_par *par = info->par; + int base; + + base = (var->yoffset * info->fix.line_length + + (var->xoffset & ~1) * ((info->var.bits_per_pixel+7) / 8)) >> 2; - savagefb_update_start(par, var); + savagefb_update_start(par, base); return 0; } -- cgit v1.2.3-70-g09d2 From 8e42a962a279369ba3e6a25f321c7cd4d471e633 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: sisfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Fix checkpatch.pl warnings in the surrounding code. Signed-off-by: Laurent Pinchart --- drivers/video/sis/sis_main.c | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) (limited to 'drivers') diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c index 75259845933..078ca2167d6 100644 --- a/drivers/video/sis/sis_main.c +++ b/drivers/video/sis/sis_main.c @@ -1333,19 +1333,14 @@ sisfb_set_base_CRT2(struct sis_video_info *ivideo, unsigned int base) } static int -sisfb_pan_var(struct sis_video_info *ivideo, struct fb_var_screeninfo *var) +sisfb_pan_var(struct sis_video_info *ivideo, struct fb_info *info, + struct fb_var_screeninfo *var) { - if(var->xoffset > (var->xres_virtual - var->xres)) { - return -EINVAL; - } - if(var->yoffset > (var->yres_virtual - var->yres)) { - return -EINVAL; - } - - ivideo->current_base = (var->yoffset * var->xres_virtual) + var->xoffset; + ivideo->current_base = var->yoffset * info->var.xres_virtual + + var->xoffset; /* calculate base bpp dep. */ - switch(var->bits_per_pixel) { + switch (info->var.bits_per_pixel) { case 32: break; case 16: @@ -1635,20 +1630,15 @@ sisfb_pan_display(struct fb_var_screeninfo *var, struct fb_info* info) struct sis_video_info *ivideo = (struct sis_video_info *)info->par; int err; - if(var->xoffset > (var->xres_virtual - var->xres)) - return -EINVAL; - - if(var->yoffset > (var->yres_virtual - var->yres)) - return -EINVAL; - - if(var->vmode & FB_VMODE_YWRAP) + if (var->vmode & FB_VMODE_YWRAP) return -EINVAL; - if(var->xoffset + info->var.xres > info->var.xres_virtual || - var->yoffset + info->var.yres > info->var.yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; - if((err = sisfb_pan_var(ivideo, var)) < 0) + err = sisfb_pan_var(ivideo, info, var); + if (err < 0) return err; info->var.xoffset = var->xoffset; -- cgit v1.2.3-70-g09d2 From 0aa76b0ce163f929b4e8f41331073814b0ef8612 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: sm501fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/sm501fb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers') diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c index 6294dca9550..a78254cf8e8 100644 --- a/drivers/video/sm501fb.c +++ b/drivers/video/sm501fb.c @@ -582,7 +582,7 @@ static int sm501fb_pan_crt(struct fb_var_screeninfo *var, { struct sm501fb_par *par = info->par; struct sm501fb_info *fbi = par->info; - unsigned int bytes_pixel = var->bits_per_pixel / 8; + unsigned int bytes_pixel = info->var.bits_per_pixel / 8; unsigned long reg; unsigned long xoffs; @@ -614,10 +614,10 @@ static int sm501fb_pan_pnl(struct fb_var_screeninfo *var, struct sm501fb_info *fbi = par->info; unsigned long reg; - reg = var->xoffset | (var->xres_virtual << 16); + reg = var->xoffset | (info->var.xres_virtual << 16); smc501_writel(reg, fbi->regs + SM501_DC_PANEL_FB_WIDTH); - reg = var->yoffset | (var->yres_virtual << 16); + reg = var->yoffset | (info->var.yres_virtual << 16); smc501_writel(reg, fbi->regs + SM501_DC_PANEL_FB_HEIGHT); sm501fb_sync_regs(fbi); -- cgit v1.2.3-70-g09d2 From 4541dbe154c0703cf47c43389b3544884f5f3522 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: tridentfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/tridentfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/tridentfb.c b/drivers/video/tridentfb.c index c6c77562839..34cf019bba4 100644 --- a/drivers/video/tridentfb.c +++ b/drivers/video/tridentfb.c @@ -987,8 +987,8 @@ static int tridentfb_pan_display(struct fb_var_screeninfo *var, unsigned int offset; debug("enter\n"); - offset = (var->xoffset + (var->yoffset * var->xres_virtual)) - * var->bits_per_pixel / 32; + offset = (var->xoffset + (var->yoffset * info->var.xres_virtual)) + * info->var.bits_per_pixel / 32; set_screen_start(par, offset); debug("exit\n"); return 0; -- cgit v1.2.3-70-g09d2 From 2883cebabbc4efc00408024d284a0230ad3af8a0 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: vfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/vfb.c b/drivers/video/vfb.c index bc67251f1a2..bf2f78065cf 100644 --- a/drivers/video/vfb.c +++ b/drivers/video/vfb.c @@ -395,8 +395,8 @@ static int vfb_pan_display(struct fb_var_screeninfo *var, || var->xoffset) return -EINVAL; } else { - if (var->xoffset + var->xres > info->var.xres_virtual || - var->yoffset + var->yres > info->var.yres_virtual) + if (var->xoffset + info->var.xres > info->var.xres_virtual || + var->yoffset + info->var.yres > info->var.yres_virtual) return -EINVAL; } info->var.xoffset = var->xoffset; -- cgit v1.2.3-70-g09d2 From c272d64111c4fdc0b6a2122452e98a3315bd6b4b Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: vga16fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vga16fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c index 305c975b178..0267acd8dc8 100644 --- a/drivers/video/vga16fb.c +++ b/drivers/video/vga16fb.c @@ -207,7 +207,7 @@ static void vga16fb_pan_var(struct fb_info *info, * granularity if someone supports xoffset in bit resolution */ vga_io_r(VGA_IS1_RC); /* reset flip-flop */ vga_io_w(VGA_ATT_IW, VGA_ATC_PEL); - if (var->bits_per_pixel == 8) + if (info->var.bits_per_pixel == 8) vga_io_w(VGA_ATT_IW, (xoffset & 3) << 1); else vga_io_w(VGA_ATT_IW, xoffset & 7); -- cgit v1.2.3-70-g09d2 From 8f0246d6287fbb37c05b7983ff61c7f57ad86a92 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: vt8500lcdfb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vt8500lcdfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers') diff --git a/drivers/video/vt8500lcdfb.c b/drivers/video/vt8500lcdfb.c index 0e120d67eb6..c13c246be9a 100644 --- a/drivers/video/vt8500lcdfb.c +++ b/drivers/video/vt8500lcdfb.c @@ -210,8 +210,8 @@ static int vt8500lcd_pan_display(struct fb_var_screeninfo *var, struct vt8500lcd_info *fbi = to_vt8500lcd_info(info); writel((1 << 31) - | (((var->xres_virtual - var->xres) * pixlen / 4) << 20) - | (off >> 2), fbi->regbase + 0x20); + | (((info->var.xres_virtual - info->var.xres) * pixlen / 4) << 20) + | (off >> 2), fbi->regbase + 0x20); return 0; } -- cgit v1.2.3-70-g09d2 From 10a6c1de2ca2761f87c9bd62ab882577a80995f1 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: vt8623fb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/video/vt8623fb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'drivers') diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c index f9b3e3dc242..4e74d262cf3 100644 --- a/drivers/video/vt8623fb.c +++ b/drivers/video/vt8623fb.c @@ -620,13 +620,14 @@ static int vt8623fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *i unsigned int offset; /* Calculate the offset */ - if (var->bits_per_pixel == 0) { - offset = (var->yoffset / 16) * var->xres_virtual + var->xoffset; + if (info->var.bits_per_pixel == 0) { + offset = (var->yoffset / 16) * info->var.xres_virtual + + var->xoffset; offset = offset >> 3; } else { offset = (var->yoffset * info->fix.line_length) + - (var->xoffset * var->bits_per_pixel / 8); - offset = offset >> ((var->bits_per_pixel == 4) ? 2 : 1); + (var->xoffset * info->var.bits_per_pixel / 8); + offset = offset >> ((info->var.bits_per_pixel == 4) ? 2 : 1); } /* Set the offset */ -- cgit v1.2.3-70-g09d2 From 0d5c6ca30bb0190c0a63fd6452c71051fb6bfbe4 Mon Sep 17 00:00:00 2001 From: Laurent Pinchart Date: Wed, 25 May 2011 11:34:52 +0200 Subject: staging: xgifb: use display information in info not in var for panning We must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Signed-off-by: Laurent Pinchart --- drivers/staging/xgifb/XGI_main_26.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) (limited to 'drivers') diff --git a/drivers/staging/xgifb/XGI_main_26.c b/drivers/staging/xgifb/XGI_main_26.c index 4403e5f8059..f8b88add952 100644 --- a/drivers/staging/xgifb/XGI_main_26.c +++ b/drivers/staging/xgifb/XGI_main_26.c @@ -1364,26 +1364,16 @@ static int XGIfb_do_set_var(struct fb_var_screeninfo *var, int isactive, } #ifdef XGIFB_PAN -static int XGIfb_pan_var(struct fb_var_screeninfo *var) +static int XGIfb_pan_var(struct fb_var_screeninfo *var, struct fb_info *info) { unsigned int base; /* printk("Inside pan_var"); */ - if (var->xoffset > (var->xres_virtual - var->xres)) { - /* printk("Pan: xo: %d xv %d xr %d\n", - var->xoffset, var->xres_virtual, var->xres); */ - return -EINVAL; - } - if (var->yoffset > (var->yres_virtual - var->yres)) { - /* printk("Pan: yo: %d yv %d yr %d\n", - var->yoffset, var->yres_virtual, var->yres); */ - return -EINVAL; - } - base = var->yoffset * var->xres_virtual + var->xoffset; + base = var->yoffset * info->var.xres_virtual + var->xoffset; /* calculate base bpp dep. */ - switch (var->bits_per_pixel) { + switch (info->var.bits_per_pixel) { case 16: base >>= 1; break; @@ -1681,9 +1671,9 @@ static int XGIfb_pan_display(struct fb_var_screeninfo *var, /* printk("\nInside pan_display:\n"); */ - if (var->xoffset > (var->xres_virtual - var->xres)) + if (var->xoffset > (info->var.xres_virtual - info->var.xres)) return -EINVAL; - if (var->yoffset > (var->yres_virtual - var->yres)) + if (var->yoffset > (info->var.yres_virtual - info->var.yres)) return -EINVAL; if (var->vmode & FB_VMODE_YWRAP) { @@ -1696,7 +1686,7 @@ static int XGIfb_pan_display(struct fb_var_screeninfo *var, > info->var.yres_virtual) return -EINVAL; } - err = XGIfb_pan_var(var); + err = XGIfb_pan_var(var, info); if (err < 0) return err; -- cgit v1.2.3-70-g09d2