Commit 24210071 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'fbdev-fixes-for-linus' of... 

Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x

* 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-3.x:
  video: Fix use-after-free by vga16fb on rmmod
  video: Convert vmalloc/memset to vzalloc
  efifb: Disallow manual bind and unbind
  efifb: Fix mismatched request/release_mem_region
  efifb: Enable write-combining
  drivers/video/pxa168fb.c: add missing clk_put
  drivers/video/imxfb.c: add missing clk_put
  fbdev: bf537-lq035: add missing blacklight properties type
  savagefb: Use panel CVT mode as default
  fbdev: sh_mobile_lcdcfb: Fix up fallout from MERAM changes.
parents 83973451 a50d28de

drivers/video/arcfb.c

+2 −3
Original line number Diff line number Diff line
@@ -515,11 +515,10 @@ static int __devinit arcfb_probe(struct platform_device *dev) 


	/* We need a flat backing store for the Arc's

	   less-flat actual paged framebuffer */

	if (!(videomemory = vmalloc(videomemorysize)))

	videomemory = vzalloc(videomemorysize);

	if (!videomemory)

		return retval;



	memset(videomemory, 0, videomemorysize);



	info = framebuffer_alloc(sizeof(struct arcfb_par), &dev->dev);

	if (!info)

		goto err;

drivers/video/bf537-lq035.c

+1 −0
Original line number Diff line number Diff line
@@ -789,6 +789,7 @@ static int __devinit bfin_lq035_probe(struct platform_device *pdev) 
	i2c_add_driver(&ad5280_driver);



	memset(&props, 0, sizeof(props));

	props.type = BACKLIGHT_RAW;

	props.max_brightness = MAX_BRIGHENESS;

	bl_dev = backlight_device_register("bf537-bl", NULL, NULL,

					   &bfin_lq035fb_bl_ops, &props);

drivers/video/broadsheetfb.c

+1 −3
Original line number Diff line number Diff line
@@ -1101,12 +1101,10 @@ static int __devinit broadsheetfb_probe(struct platform_device *dev) 


	videomemorysize = roundup((dpyw*dpyh), PAGE_SIZE);



	videomemory = vmalloc(videomemorysize);

	videomemory = vzalloc(videomemorysize);

	if (!videomemory)

		goto err_fb_rel;



	memset(videomemory, 0, videomemorysize);



	info->screen_base = (char *)videomemory;

	info->fbops = &broadsheetfb_ops;

drivers/video/efifb.c

+22 −12
Original line number Diff line number Diff line
@@ -16,6 +16,8 @@ 
#include <linux/pci.h>

#include <video/vga.h>



static bool request_mem_succeeded = false;



static struct fb_var_screeninfo efifb_defined __devinitdata = {

	.activate		= FB_ACTIVATE_NOW,

	.height			= -1,
@@ -281,7 +283,9 @@ static void efifb_destroy(struct fb_info *info) 
{

	if (info->screen_base)

		iounmap(info->screen_base);

	release_mem_region(info->apertures->ranges[0].base, info->apertures->ranges[0].size);

	if (request_mem_succeeded)

		release_mem_region(info->apertures->ranges[0].base,

				   info->apertures->ranges[0].size);

	framebuffer_release(info);

}
@@ -326,14 +330,13 @@ static int __init efifb_setup(char *options) 
	return 0;

}



static int __devinit efifb_probe(struct platform_device *dev)

static int __init efifb_probe(struct platform_device *dev)

{

	struct fb_info *info;

	int err;

	unsigned int size_vmode;

	unsigned int size_remap;

	unsigned int size_total;

	int request_succeeded = 0;



	if (!screen_info.lfb_depth)

		screen_info.lfb_depth = 32;
@@ -387,7 +390,7 @@ static int __devinit efifb_probe(struct platform_device *dev) 
	efifb_fix.smem_len = size_remap;



	if (request_mem_region(efifb_fix.smem_start, size_remap, "efifb")) {

		request_succeeded = 1;

		request_mem_succeeded = true;

	} else {

		/* We cannot make this fatal. Sometimes this comes from magic

		   spaces our resource handlers simply don't know about */
@@ -413,7 +416,7 @@ static int __devinit efifb_probe(struct platform_device *dev) 
	info->apertures->ranges[0].base = efifb_fix.smem_start;

	info->apertures->ranges[0].size = size_remap;



	info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);

	info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);

	if (!info->screen_base) {

		printk(KERN_ERR "efifb: abort, cannot ioremap video memory "

				"0x%x @ 0x%lx\n",
@@ -491,13 +494,12 @@ err_unmap: 
err_release_fb:

	framebuffer_release(info);

err_release_mem:

	if (request_succeeded)

	if (request_mem_succeeded)

		release_mem_region(efifb_fix.smem_start, size_total);

	return err;

}



static struct platform_driver efifb_driver = {

	.probe	= efifb_probe,

	.driver	= {

		.name	= "efifb",

	},
@@ -528,13 +530,21 @@ static int __init efifb_init(void) 
	if (!screen_info.lfb_linelength)

		return -ENODEV;



	ret = platform_driver_register(&efifb_driver);



	if (!ret) {

	ret = platform_device_register(&efifb_device);

	if (ret)

			platform_driver_unregister(&efifb_driver);

		return ret;



	/*

	 * This is not just an optimization.  We will interfere

	 * with a real driver if we get reprobed, so don't allow

	 * it.

	 */

	ret = platform_driver_probe(&efifb_driver, efifb_probe);

	if (ret) {

		platform_device_unregister(&efifb_driver);

		return ret;

	}



	return ret;

}

module_init(efifb_init);

drivers/video/hecubafb.c

+2 −3
Original line number Diff line number Diff line
@@ -231,11 +231,10 @@ static int __devinit hecubafb_probe(struct platform_device *dev) 


	videomemorysize = (DPY_W*DPY_H)/8;



	if (!(videomemory = vmalloc(videomemorysize)))

	videomemory = vzalloc(videomemorysize);

	if (!videomemory)

		return retval;



	memset(videomemory, 0, videomemorysize);



	info = framebuffer_alloc(sizeof(struct hecubafb_par), &dev->dev);

	if (!info)

		goto err_fballoc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE