Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ebf84320 authored by Thomas Zimmermann's avatar Thomas Zimmermann Committed by Greg Kroah-Hartman
Browse files

fbdev: Fix sys_imageblit() for arbitrary image widths 



[ Upstream commit 61bfcb6a3b981e8f19e044ac8c3de6edbe6caf70 ]

Commit 6f29e04938bf ("fbdev: Improve performance of sys_imageblit()")
broke sys_imageblit() for image width that are not aligned to 8-bit
boundaries. Fix this by handling the trailing pixels on each line
separately. The performance improvements in the original commit do not
regress by this change.

Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Fixes: 6f29e04938bf ("fbdev: Improve performance of sys_imageblit()")
Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
Acked-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Tested-by: default avatarGeert Uytterhoeven <geert@linux-m68k.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20220313192952.12058-2-tzimmermann@suse.de


Stable-dep-of: c2d22806aecb ("fbdev: fix potential OOB read in fast_imageblit()")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 96f8e806

drivers/video/fbdev/core/sysimgblt.c

+25 −4
Original line number Diff line number Diff line
@@ -188,7 +188,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, 
{

	u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel;

	u32 ppw = 32/bpp, spitch = (image->width + 7)/8;

	u32 bit_mask, eorx;

	u32 bit_mask, eorx, shift;

	const char *s = image->data, *src;

	u32 *dst;

	const u32 *tab;
@@ -229,17 +229,23 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, 


	for (i = image->height; i--; ) {

		dst = dst1;

		shift = 8;

		src = s;



		/*

		 * Manually unroll the per-line copying loop for better

		 * performance. This works until we processed the last

		 * completely filled source byte (inclusive).

		 */

		switch (ppw) {

		case 4: /* 8 bpp */

			for (j = k; j; j -= 2, ++src) {

			for (j = k; j >= 2; j -= 2, ++src) {

				*dst++ = colortab[(*src >> 4) & bit_mask];

				*dst++ = colortab[(*src >> 0) & bit_mask];

			}

			break;

		case 2: /* 16 bpp */

			for (j = k; j; j -= 4, ++src) {

			for (j = k; j >= 4; j -= 4, ++src) {

				*dst++ = colortab[(*src >> 6) & bit_mask];

				*dst++ = colortab[(*src >> 4) & bit_mask];

				*dst++ = colortab[(*src >> 2) & bit_mask];
@@ -247,7 +253,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, 
			}

			break;

		case 1: /* 32 bpp */

			for (j = k; j; j -= 8, ++src) {

			for (j = k; j >= 8; j -= 8, ++src) {

				*dst++ = colortab[(*src >> 7) & bit_mask];

				*dst++ = colortab[(*src >> 6) & bit_mask];

				*dst++ = colortab[(*src >> 5) & bit_mask];
@@ -259,6 +265,21 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, 
			}

			break;

		}



		/*

		 * For image widths that are not a multiple of 8, there

		 * are trailing pixels left on the current line. Print

		 * them as well.

		 */

		for (; j--; ) {

			shift -= ppw;

			*dst++ = colortab[(*src >> shift) & bit_mask];

			if (!shift) {

				shift = 8;

				++src;

			}

		}



		dst1 += p->fix.line_length;

		s += spitch;

	}