mirror of https://github.com/torvalds/linux.git
eb76d0f555
Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB
access in fbcon_remap_all(). Without holding the console lock the call
races with switching outputs.
VGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon
function uses struct fb_info.node, which is set by register_framebuffer().
As the fb-helper code currently sets up VGA switcheroo before registering
the framebuffer, the value of node is -1 and therefore not a legal value.
For example, fbcon uses the value within set_con2fb_map() [1] as an index
into an array.
Moving vga_switcheroo_client_fb_set() after register_framebuffer() can
result in VGA switching that does not switch fbcon correctly.
Therefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),
which already holds the console lock. Fbdev calls fbcon_fb_registered()
from within register_framebuffer(). Serializes the helper with VGA
switcheroo's call to fbcon_remap_all().
Although vga_switcheroo_client_fb_set() takes an instance of struct fb_info
as parameter, it really only needs the contained fbcon state. Moving the
call to fbcon initialization is therefore cleaner than before. Only amdgpu,
i915, nouveau and radeon support vga_switcheroo. For all other drivers,
this change does nothing.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://elixir.bootlin.com/linux/v6.17/source/drivers/video/fbdev/core/fbcon.c#L2942 # [1]
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| bitblit.c | ||
| cfbcopyarea.c | ||
| cfbfillrect.c | ||
| cfbimgblt.c | ||
| cfbmem.h | ||
| fb_backlight.c | ||
| fb_chrdev.c | ||
| fb_cmdline.c | ||
| fb_copyarea.h | ||
| fb_ddc.c | ||
| fb_defio.c | ||
| fb_draw.h | ||
| fb_fillrect.h | ||
| fb_imageblit.h | ||
| fb_info.c | ||
| fb_internal.h | ||
| fb_io_fops.c | ||
| fb_logo.c | ||
| fb_notify.c | ||
| fb_procfs.c | ||
| fb_sys_fops.c | ||
| fbcmap.c | ||
| fbcon.c | ||
| fbcon.h | ||
| fbcon_ccw.c | ||
| fbcon_cw.c | ||
| fbcon_rotate.c | ||
| fbcon_rotate.h | ||
| fbcon_ud.c | ||
| fbcvt.c | ||
| fbmem.c | ||
| fbmon.c | ||
| fbsysfs.c | ||
| modedb.c | ||
| softcursor.c | ||
| svgalib.c | ||
| syscopyarea.c | ||
| sysfillrect.c | ||
| sysimgblt.c | ||
| sysmem.h | ||
| tileblit.c | ||