[PATCH] fbdev: Pan display fixes

- Fix fb_pan_display rejecting yoffsets that are valid if panning mode
  is ywrap.

- Add more robust error checking in fb_pan_display specially since this
  function is accessible by userland apps.

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 6240aedb41543f6870f1df4f3ddfaec8344a7f7a..10dfdf0352644d296247f3a18f17c3302f615189 100644 (file)
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -722,14 +722,30 @@ static void try_to_load(int fb)
 int
 fb_pan_display(struct fb_info *info, struct fb_var_screeninfo *var)
 {
+       struct fb_fix_screeninfo *fix = &info->fix;
         int xoffset = var->xoffset;
         int yoffset = var->yoffset;
-        int err;
+        int err = 0, yres = info->var.yres;
+
+       if (var->yoffset > 0) {
+               if (var->vmode & FB_VMODE_YWRAP) {
+                       if (!fix->ywrapstep || (var->yoffset % fix->ywrapstep))
+                               err = -EINVAL;
+                       else
+                               yres = 0;
+               } else if (!fix->ypanstep || (var->yoffset % fix->ypanstep))
+                       err = -EINVAL;
+       }
+
+       if (var->xoffset > 0 && (!fix->xpanstep ||
+                                (var->xoffset % fix->xpanstep)))
+               err = -EINVAL;
+
+        if (err || !info->fbops->fb_pan_display || xoffset < 0 ||
+           yoffset < 0 || var->yoffset + yres > info->var.yres_virtual ||
+           var->xoffset + info->var.xres > info->var.xres_virtual)
+               return -EINVAL;
 
-        if (xoffset < 0 || yoffset < 0 || !info->fbops->fb_pan_display ||
-            xoffset + info->var.xres > info->var.xres_virtual ||
-            yoffset + info->var.yres > info->var.yres_virtual)
-                return -EINVAL;
        if ((err = info->fbops->fb_pan_display(var, info)))
                return err;
         info->var.xoffset = var->xoffset;