aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2011-06-07 18:41:26 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2011-06-07 18:41:26 -0700
commit24210071e0dd7da1a945a2a1686b93f2b2f3b410 (patch)
treec1cc29bd3853782f450fda9a1c73ca9c183d71b5
parent8397345172aa5cdcbc133977af9d525f45b874ea (diff)
parenta50d28de8d5085e0f34f96088a45cc156d022021 (diff)
Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x
* 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x: video: Fix use-after-free by vga16fb on rmmod video: Convert vmalloc/memset to vzalloc efifb: Disallow manual bind and unbind efifb: Fix mismatched request/release_mem_region efifb: Enable write-combining drivers/video/pxa168fb.c: add missing clk_put drivers/video/imxfb.c: add missing clk_put fbdev: bf537-lq035: add missing blacklight properties type savagefb: Use panel CVT mode as default fbdev: sh_mobile_lcdcfb: Fix up fallout from MERAM changes.
-rw-r--r--drivers/video/arcfb.c5
-rw-r--r--drivers/video/bf537-lq035.c1
-rw-r--r--drivers/video/broadsheetfb.c4
-rw-r--r--drivers/video/efifb.c34
-rw-r--r--drivers/video/hecubafb.c5
-rw-r--r--drivers/video/imxfb.c4
-rw-r--r--drivers/video/metronomefb.c4
-rw-r--r--drivers/video/modedb.c1
-rw-r--r--drivers/video/pxa168fb.c17
-rw-r--r--drivers/video/savage/savagefb_driver.c16
-rw-r--r--drivers/video/sh_mobile_lcdcfb.c4
-rw-r--r--drivers/video/vga16fb.c2
-rw-r--r--drivers/video/xen-fbfront.c3
13 files changed, 63 insertions, 37 deletions
diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index 3ec4923c2d8..c22e8d39a2c 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -515,11 +515,10 @@ static int __devinit arcfb_probe(struct platform_device *dev)
/* We need a flat backing store for the Arc's
less-flat actual paged framebuffer */
- if (!(videomemory = vmalloc(videomemorysize)))
+ videomemory = vzalloc(videomemorysize);
+ if (!videomemory)
return retval;
- memset(videomemory, 0, videomemorysize);
-
info = framebuffer_alloc(sizeof(struct arcfb_par), &dev->dev);
if (!info)
goto err;
diff --git a/drivers/video/bf537-lq035.c b/drivers/video/bf537-lq035.c
index 47c21fb2c82..bea53c1a495 100644
--- a/drivers/video/bf537-lq035.c
+++ b/drivers/video/bf537-lq035.c
@@ -789,6 +789,7 @@ static int __devinit bfin_lq035_probe(struct platform_device *pdev)
i2c_add_driver(&ad5280_driver);
memset(&props, 0, sizeof(props));
+ props.type = BACKLIGHT_RAW;
props.max_brightness = MAX_BRIGHENESS;
bl_dev = backlight_device_register("bf537-bl", NULL, NULL,
&bfin_lq035fb_bl_ops, &props);
diff --git a/drivers/video/broadsheetfb.c b/drivers/video/broadsheetfb.c
index ebda6876d3a..377dde3d5bf 100644
--- a/drivers/video/broadsheetfb.c
+++ b/drivers/video/broadsheetfb.c
@@ -1101,12 +1101,10 @@ static int __devinit broadsheetfb_probe(struct platform_device *dev)
videomemorysize = roundup((dpyw*dpyh), PAGE_SIZE);
- videomemory = vmalloc(videomemorysize);
+ videomemory = vzalloc(videomemorysize);
if (!videomemory)
goto err_fb_rel;
- memset(videomemory, 0, videomemorysize);
-
info->screen_base = (char *)videomemory;
info->fbops = &broadsheetfb_ops;
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index fb205843c2c..69c49dfce9c 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -16,6 +16,8 @@
#include <linux/pci.h>
#include <video/vga.h>
+static bool request_mem_succeeded = false;
+
static struct fb_var_screeninfo efifb_defined __devinitdata = {
.activate = FB_ACTIVATE_NOW,
.height = -1,
@@ -281,7 +283,9 @@ static void efifb_destroy(struct fb_info *info)
{
if (info->screen_base)
iounmap(info->screen_base);
- release_mem_region(info->apertures->ranges[0].base, info->apertures->ranges[0].size);
+ if (request_mem_succeeded)
+ release_mem_region(info->apertures->ranges[0].base,
+ info->apertures->ranges[0].size);
framebuffer_release(info);
}
@@ -326,14 +330,13 @@ static int __init efifb_setup(char *options)
return 0;
}
-static int __devinit efifb_probe(struct platform_device *dev)
+static int __init efifb_probe(struct platform_device *dev)
{
struct fb_info *info;
int err;
unsigned int size_vmode;
unsigned int size_remap;
unsigned int size_total;
- int request_succeeded = 0;
if (!screen_info.lfb_depth)
screen_info.lfb_depth = 32;
@@ -387,7 +390,7 @@ static int __devinit efifb_probe(struct platform_device *dev)
efifb_fix.smem_len = size_remap;
if (request_mem_region(efifb_fix.smem_start, size_remap, "efifb")) {
- request_succeeded = 1;
+ request_mem_succeeded = true;
} else {
/* We cannot make this fatal. Sometimes this comes from magic
spaces our resource handlers simply don't know about */
@@ -413,7 +416,7 @@ static int __devinit efifb_probe(struct platform_device *dev)
info->apertures->ranges[0].base = efifb_fix.smem_start;
info->apertures->ranges[0].size = size_remap;
- info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
+ info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
if (!info->screen_base) {
printk(KERN_ERR "efifb: abort, cannot ioremap video memory "
"0x%x @ 0x%lx\n",
@@ -491,13 +494,12 @@ err_unmap:
err_release_fb:
framebuffer_release(info);
err_release_mem:
- if (request_succeeded)
+ if (request_mem_succeeded)
release_mem_region(efifb_fix.smem_start, size_total);
return err;
}
static struct platform_driver efifb_driver = {
- .probe = efifb_probe,
.driver = {
.name = "efifb",
},
@@ -528,13 +530,21 @@ static int __init efifb_init(void)
if (!screen_info.lfb_linelength)
return -ENODEV;
- ret = platform_driver_register(&efifb_driver);
+ ret = platform_device_register(&efifb_device);
+ if (ret)
+ return ret;
- if (!ret) {
- ret = platform_device_register(&efifb_device);
- if (ret)
- platform_driver_unregister(&efifb_driver);
+ /*
+ * This is not just an optimization. We will interfere
+ * with a real driver if we get reprobed, so don't allow
+ * it.
+ */
+ ret = platform_driver_probe(&efifb_driver, efifb_probe);
+ if (ret) {
+ platform_device_unregister(&efifb_driver);
+ return ret;
}
+
return ret;
}
module_init(efifb_init);
diff --git a/drivers/video/hecubafb.c b/drivers/video/hecubafb.c
index 1b94643ecbc..fbef15f7a21 100644
--- a/drivers/video/hecubafb.c
+++ b/drivers/video/hecubafb.c
@@ -231,11 +231,10 @@ static int __devinit hecubafb_probe(struct platform_device *dev)
videomemorysize = (DPY_W*DPY_H)/8;
- if (!(videomemory = vmalloc(videomemorysize)))
+ videomemory = vzalloc(videomemorysize);
+ if (!videomemory)
return retval;
- memset(videomemory, 0, videomemorysize);
-
info = framebuffer_alloc(sizeof(struct hecubafb_par), &dev->dev);
if (!info)
goto err_fballoc;
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index d2ccfd6e662..f135dbead07 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -856,10 +856,10 @@ failed_platform_init:
dma_free_writecombine(&pdev->dev,fbi->map_size,fbi->map_cpu,
fbi->map_dma);
failed_map:
- clk_put(fbi->clk);
-failed_getclock:
iounmap(fbi->regs);
failed_ioremap:
+ clk_put(fbi->clk);
+failed_getclock:
release_mem_region(res->start, resource_size(res));
failed_req:
kfree(info->pseudo_palette);
diff --git a/drivers/video/metronomefb.c b/drivers/video/metronomefb.c
index ed64edfd2c4..97d45e5115e 100644
--- a/drivers/video/metronomefb.c
+++ b/drivers/video/metronomefb.c
@@ -628,12 +628,10 @@ static int __devinit metronomefb_probe(struct platform_device *dev)
/* we need to add a spare page because our csum caching scheme walks
* to the end of the page */
videomemorysize = PAGE_SIZE + (fw * fh);
- videomemory = vmalloc(videomemorysize);
+ videomemory = vzalloc(videomemorysize);
if (!videomemory)
goto err_fb_rel;
- memset(videomemory, 0, videomemorysize);
-
info->screen_base = (char __force __iomem *)videomemory;
info->fbops = &metronomefb_ops;
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index 48c3ea8652b..cb175fe7abc 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -1128,3 +1128,4 @@ EXPORT_SYMBOL(fb_find_best_mode);
EXPORT_SYMBOL(fb_find_nearest_mode);
EXPORT_SYMBOL(fb_videomode_to_modelist);
EXPORT_SYMBOL(fb_find_mode);
+EXPORT_SYMBOL(fb_find_mode_cvt);
diff --git a/drivers/video/pxa168fb.c b/drivers/video/pxa168fb.c
index 35f61dd0cb3..bb95ec56d25 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/pxa168fb.c
@@ -623,19 +623,21 @@ static int __devinit pxa168fb_probe(struct platform_device *pdev)
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (res == NULL) {
dev_err(&pdev->dev, "no IO memory defined\n");
- return -ENOENT;
+ ret = -ENOENT;
+ goto failed_put_clk;
}
irq = platform_get_irq(pdev, 0);
if (irq < 0) {
dev_err(&pdev->dev, "no IRQ defined\n");
- return -ENOENT;
+ ret = -ENOENT;
+ goto failed_put_clk;
}
info = framebuffer_alloc(sizeof(struct pxa168fb_info), &pdev->dev);
if (info == NULL) {
- clk_put(clk);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto failed_put_clk;
}
/* Initialize private data */
@@ -671,7 +673,7 @@ static int __devinit pxa168fb_probe(struct platform_device *pdev)
fbi->reg_base = ioremap_nocache(res->start, resource_size(res));
if (fbi->reg_base == NULL) {
ret = -ENOMEM;
- goto failed;
+ goto failed_free_info;
}
/*
@@ -683,7 +685,7 @@ static int __devinit pxa168fb_probe(struct platform_device *pdev)
&fbi->fb_start_dma, GFP_KERNEL);
if (info->screen_base == NULL) {
ret = -ENOMEM;
- goto failed;
+ goto failed_free_info;
}
info->fix.smem_start = (unsigned long)fbi->fb_start_dma;
@@ -772,8 +774,9 @@ failed_free_clk:
failed_free_fbmem:
dma_free_coherent(fbi->dev, info->fix.smem_len,
info->screen_base, fbi->fb_start_dma);
-failed:
+failed_free_info:
kfree(info);
+failed_put_clk:
clk_put(clk);
dev_err(&pdev->dev, "frame buffer device init failed with %d\n", ret);
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 3b7f2f5bae7..4de541ca9c5 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -2237,6 +2237,22 @@ static int __devinit savagefb_probe(struct pci_dev* dev,
&info->modelist);
#endif
info->var = savagefb_var800x600x8;
+ /* if a panel was detected, default to a CVT mode instead */
+ if (par->SavagePanelWidth) {
+ struct fb_videomode cvt_mode;
+
+ memset(&cvt_mode, 0, sizeof(cvt_mode));
+ cvt_mode.xres = par->SavagePanelWidth;
+ cvt_mode.yres = par->SavagePanelHeight;
+ cvt_mode.refresh = 60;
+ /* FIXME: if we know there is only the panel
+ * we can enable reduced blanking as well */
+ if (fb_find_mode_cvt(&cvt_mode, 0, 0))
+ printk(KERN_WARNING "No CVT mode found for panel\n");
+ else if (fb_find_mode(&info->var, info, NULL, NULL, 0,
+ &cvt_mode, 0) != 3)
+ info->var = savagefb_var800x600x8;
+ }
if (mode_option) {
fb_find_mode(&info->var, info, mode_option,
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 404c03b4b7c..019dbd3f12b 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -470,7 +470,7 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
unsigned long tmp;
int bpp = 0;
unsigned long ldddsr;
- int k, m;
+ int k, m, ret;
/* enable clocks before accessing the hardware */
for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
@@ -540,7 +540,7 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
board_cfg = &ch->cfg.board_cfg;
if (board_cfg->setup_sys) {
- int ret = board_cfg->setup_sys(board_cfg->board_data,
+ ret = board_cfg->setup_sys(board_cfg->board_data,
ch, &sh_mobile_lcdc_sys_bus_ops);
if (ret)
return ret;
diff --git a/drivers/video/vga16fb.c b/drivers/video/vga16fb.c
index 53b2c5aae06..305c975b178 100644
--- a/drivers/video/vga16fb.c
+++ b/drivers/video/vga16fb.c
@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_info *info, const struct fb_image *image
static void vga16fb_destroy(struct fb_info *info)
{
+ struct platform_device *dev = container_of(info->device, struct platform_device, dev);
iounmap(info->screen_base);
fb_dealloc_cmap(&info->cmap);
/* XXX unshare VGA regions */
+ platform_set_drvdata(dev, NULL);
framebuffer_release(info);
}
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index a20218c2fda..beac52fc1c0 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -395,10 +395,9 @@ static int __devinit xenfb_probe(struct xenbus_device *dev,
spin_lock_init(&info->dirty_lock);
spin_lock_init(&info->resize_lock);
- info->fb = vmalloc(fb_size);
+ info->fb = vzalloc(fb_size);
if (info->fb == NULL)
goto error_nomem;
- memset(info->fb, 0, fb_size);
info->nr_pages = (fb_size + PAGE_SIZE - 1) >> PAGE_SHIFT;