mirror of https://github.com/torvalds/linux.git
eb76d0f555
Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB
access in fbcon_remap_all(). Without holding the console lock the call
races with switching outputs.
VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon
function uses struct fb_info.node, which is set by register_framebuffer().
As the fb-helper code currently sets up VGA switcheroo before registering
the framebuffer, the value of node is -1 and therefore not a legal value.
For example, fbcon uses the value within set_con2fb_map() [1] as an index
into an array.
Moving vga_switcheroo_client_fb_set() after register_framebuffer() can
result in VGA switching that does not switch fbcon correctly.
Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),
which already holds the console lock. Fbdev calls fbcon_fb_registered()
from within register_framebuffer(). Serializes the helper with VGA
switcheroo's call to fbcon_remap_all().
Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info
as parameter, it really only needs the contained fbcon state. Moving the
call to fbcon initialization is therefore cleaner than before. Only amdgpu,
i915, nouveau and radeon support vga_switcheroo. For all other drivers,
this change does nothing.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://elixir.bootlin.com/linux/v6.17/source/drivers/video/fbdev/core/fbcon.c#L2942 # [1]
Fixes:
|
||
|---|---|---|
| .. | ||
| aty | ||
| core | ||
| geode | ||
| i810 | ||
| kyro | ||
| matrox | ||
| mb862xx | ||
| mmp | ||
| nvidia | ||
| omap | ||
| omap2 | ||
| riva | ||
| savage | ||
| sis | ||
| via | ||
| 68328fb.c | ||
| Kconfig | ||
| Makefile | ||
| acornfb.c | ||
| acornfb.h | ||
| amifb.c | ||
| arcfb.c | ||
| arkfb.c | ||
| asiliantfb.c | ||
| atafb.c | ||
| atafb.h | ||
| atafb_iplan2p2.c | ||
| atafb_iplan2p4.c | ||
| atafb_iplan2p8.c | ||
| atafb_mfb.c | ||
| atafb_utils.h | ||
| atmel_lcdfb.c | ||
| au1100fb.c | ||
| au1100fb.h | ||
| au1200fb.c | ||
| au1200fb.h | ||
| broadsheetfb.c | ||
| bt431.h | ||
| bt455.h | ||
| bw2.c | ||
| c2p.h | ||
| c2p_core.h | ||
| c2p_iplan2.c | ||
| c2p_planar.c | ||
| carminefb.c | ||
| carminefb.h | ||
| carminefb_regs.h | ||
| cg3.c | ||
| cg6.c | ||
| cg14.c | ||
| chipsfb.c | ||
| cirrusfb.c | ||
| clps711x-fb.c | ||
| cobalt_lcdfb.c | ||
| controlfb.c | ||
| controlfb.h | ||
| cyber2000fb.c | ||
| cyber2000fb.h | ||
| dnfb.c | ||
| edid.h | ||
| efifb.c | ||
| ep93xx-fb.c | ||
| ffb.c | ||
| fm2fb.c | ||
| fsl-diu-fb.c | ||
| g364fb.c | ||
| gbefb.c | ||
| goldfishfb.c | ||
| grvga.c | ||
| gxt4500.c | ||
| hecubafb.c | ||
| hgafb.c | ||
| hitfb.c | ||
| hpfb.c | ||
| hyperv_fb.c | ||
| i740_reg.h | ||
| i740fb.c | ||
| imsttfb.c | ||
| imxfb.c | ||
| leo.c | ||
| macfb.c | ||
| macmodes.c | ||
| macmodes.h | ||
| maxinefb.c | ||
| metronomefb.c | ||
| n411.c | ||
| neofb.c | ||
| ocfb.c | ||
| offb.c | ||
| p9100.c | ||
| platinumfb.c | ||
| platinumfb.h | ||
| pm2fb.c | ||
| pm3fb.c | ||
| pmag-aa-fb.c | ||
| pmag-ba-fb.c | ||
| pmagb-b-fb.c | ||
| ps3fb.c | ||
| pvr2fb.c | ||
| pxa3xx-gcu.c | ||
| pxa3xx-gcu.h | ||
| pxa3xx-regs.h | ||
| pxa168fb.c | ||
| pxa168fb.h | ||
| pxafb.c | ||
| pxafb.h | ||
| q40fb.c | ||
| s1d13xxxfb.c | ||
| s3c-fb.c | ||
| s3fb.c | ||
| sa1100fb.c | ||
| sa1100fb.h | ||
| sbuslib.c | ||
| sbuslib.h | ||
| sh7760fb.c | ||
| sh_mobile_lcdcfb.c | ||
| sh_mobile_lcdcfb.h | ||
| simplefb.c | ||
| skeletonfb.c | ||
| sm501fb.c | ||
| sm712.h | ||
| sm712fb.c | ||
| smscufx.c | ||
| ssd1307fb.c | ||
| sstfb.c | ||
| stifb.c | ||
| sunxvr500.c | ||
| sunxvr1000.c | ||
| sunxvr2500.c | ||
| tcx.c | ||
| tdfxfb.c | ||
| tgafb.c | ||
| tridentfb.c | ||
| udlfb.c | ||
| uvesafb.c | ||
| valkyriefb.c | ||
| valkyriefb.h | ||
| vesafb.c | ||
| vfb.c | ||
| vga16fb.c | ||
| vt8500lcdfb.c | ||
| vt8500lcdfb.h | ||
| vt8623fb.c | ||
| wm8505fb.c | ||
| wm8505fb_regs.h | ||
| wmt_ge_rops.c | ||
| wmt_ge_rops.h | ||
| xen-fbfront.c | ||
| xilinxfb.c | ||