From patchwork Mon Jul 16 07:44:57 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 1200111 Return-Path: X-Original-To: patchwork-linux-fbdev@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 54136E0038 for ; Mon, 16 Jul 2012 07:45:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751473Ab2GPHo7 (ORCPT ); Mon, 16 Jul 2012 03:44:59 -0400 Received: from mail-yw0-f46.google.com ([209.85.213.46]:60801 "EHLO mail-yw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751182Ab2GPHo6 (ORCPT ); Mon, 16 Jul 2012 03:44:58 -0400 Received: by yhmm54 with SMTP id m54so5025614yhm.19 for ; Mon, 16 Jul 2012 00:44:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=es2AUduzftifAE4/mh/ESXKvS4Cxzy+nMZKoj5pTtsw=; b=ugNm6Xu6MlUElKVBBPJni/tbwLV2QxIIC3hzU9GS/aP4TGJbAdDCNu7ClBCGtYtPKW BDymgBJqLTZjIqcyvnHKO+zGN+UBTeFbUfR3xhrACUmuWIXpQbRCuNxmHzgoDBWWdMDV aKprsQScopso/F2bI2XIDlG+b/4h5qR1cGJu19uqMQfDU7CGTK/DiSFh+SrC/LyEdKnT IkGAvTCBPN85jDDQ8YqN6UYvmwnKwNxhYpR/xhXRqJFRss00JHT1pkfGr4D/n9GtyRqB KFG+bG3hdMKttob5o05DDjpxpkMk083YgKFvUN+Y9N0KWSIg8jWyzGhJ8SXn6U18pclC nKHw== MIME-Version: 1.0 Received: by 10.42.29.4 with SMTP id p4mr3020773icc.30.1342424697657; Mon, 16 Jul 2012 00:44:57 -0700 (PDT) Received: by 10.231.135.1 with HTTP; Mon, 16 Jul 2012 00:44:57 -0700 (PDT) In-Reply-To: References: Date: Mon, 16 Jul 2012 09:44:57 +0200 X-Google-Sender-Auth: KxIb6yjAlry3iH9dZDR9pEGXQz4 Message-ID: Subject: Fwd: video/fbmem.c: Fix __u32 >= 0 condition in fb_do_show_logo. From: Geert Uytterhoeven To: Levin Du Cc: linux-kernel@vger.kernel.org, Linux Fbdev development list Sender: linux-fbdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fbdev@vger.kernel.org Never reached lkml due to the HTML. Resending, with a CC to linux-fbdev added. ---------- Forwarded message ---------- From: Levin Du Date: 2012/7/12 Subject: video/fbmem.c: Fix __u32 >= 0 condition in fb_do_show_logo. To: linux-kernel@vger.kernel.org Cc: brad@neruo.com Dear all, Since dx or dy in struct fb_image is unsigned 32 bit integer: struct fb_image { __u32 dx; /* Where to place image */ __u32 dy; ... } In fb_do_show_logo(), image->dx or image->dy will always meet the >= 0 condition. if the logo is large enough (same as to the whole screen, for example) and rotate is UD or CCW, and image->dx or image->dy will results in a large value which makes info->fbops->fb_imageblit fail miserably. Here is the raw patch: for (x = 0; @@ -428,9 +429,10 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, image->dx += image->width + 8; } } else if (rotate == FB_ROTATE_UD) { - for (x = 0; x < num && image->dx >= 0; x++) { + d = image->dx; + for (x = 0; x < num && d >= 0; x++) { info->fbops->fb_imageblit(info, image); - image->dx -= image->width + 8; + d -= image->width + 8; } } else if (rotate == FB_ROTATE_CW) { for (x = 0; @@ -440,9 +442,10 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, image->dy += image->height + 8; } } else if (rotate == FB_ROTATE_CCW) { - for (x = 0; x < num && image->dy >= 0; x++) { + d = image->dy; + for (x = 0; x < num && d >= 0; x++) { info->fbops->fb_imageblit(info, image); - image->dy -= image->height + 8; + d -= image->height + 8; } } } Gr{oetje,eeting}s, Geert --- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds -- To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c index ad93629..34a0ba3 100644 --- a/drivers/video/fbmem.c +++ b/drivers/video/fbmem.c @@ -419,6 +419,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, int rotate, unsigned int num) { unsigned int x; + long d; if (rotate == FB_ROTATE_UR) {