Re: [PATCH] fbdev: bitblit: Fix glyph clipping when fbcon pans

[Thomas Zimmermann <tzimmermann@suse.de>]

Hi

Am 17.10.26 um 10:53 schrieb CatMe0w:
> Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix
> vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When
> fbcon scrolls by panning, it draws text rows up to var.yres_virtual,
> so after the first pan most new text is not drawn until the next full
> redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or
> FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when
> CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y.
>
> Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already
> use as the drawing area height. When fbcon does not pan, GETVYRES()
> returns var.yres, keeping the existing bound. When fbcon pans, it
> returns var.yres_virtual, which the framebuffer memory must cover
> anyway for panning to work.
>
> Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds")
> Cc: stable@vger.kernel.org
> Signed-off-by: CatMe0w <CatMe0w@live.cn>

This patch restores fbcon on my test system with sisfb.

Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
Closes: 
https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@suse.de/

Best regards
Thomas


> ---
>   drivers/video/fbdev/core/bitblit.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
> index 39f44258d793..323a9e79a684 100644
> --- a/drivers/video/fbdev/core/bitblit.c
> +++ b/drivers/video/fbdev/core/bitblit.c
> @@ -18,6 +18,7 @@
>   #include <linux/console.h>
>   #include <asm/types.h>
>   #include "fbcon.h"
> +#include "fbcon_rotate.h"
>   
>   /*
>    * Accelerated handlers.
> @@ -150,7 +151,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
>   		      const unsigned short *s, int count, int yy, int xx,
>   		      int fg, int bg)
>   {
> +	struct fbcon_par *par = info->fbcon_par;
>   	struct fb_image image;
> +	u32 vyres = GETVYRES(par->p, info);
>   	u32 width = DIV_ROUND_UP(vc->vc_font.width, 8);
>   	u32 cellsize = width * vc->vc_font.height;
>   	u32 maxcnt = info->pixmap.size/cellsize;
> @@ -167,10 +170,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
>   	image.height = vc->vc_font.height;
>   	image.depth = 1;
>   
> -	if (image.dy >= info->var.yres)
> +	if (image.dy >= vyres)
>   		return;
>   
> -	image.height = min(image.height, info->var.yres - image.dy);
> +	image.height = min(image.height, vyres - image.dy);
>   
>   	if (attribute) {
>   		buf = kmalloc(cellsize, GFP_ATOMIC);
>
> base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Stefan Gaiser, Jochen Jaser, Abhinav Puri, (HRB 36809, AG Nürnberg)