7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yao Yiqi [ Upstream commit 10463bcd43495fb88ff667b2c5348200860f6bdc ] fbcon_rotate_font() caches a rotated copy of the console font and skips the rebuild when the fontdata pointer and the rotation match. Raw font data carries no geometry, though: width, height and charcount live in vc->vc_font. fbcon_set_font() deduplicates uploads by byte equality, so the same bytes re-uploaded with different dimensions keep the fontdata pointer while the geometry changes, and the early-out skips the rebuild. The rotated cell size depends on the geometry (rotation swaps width and height), so the stale buffer is indexed with the new cell size. Re-uploading a 4x16 font as 16x8 on a CW-rotated console, for example, doubles the rotated cell size and reads past the end of the old buffer. Record the geometry the buffer was built from and compare it in the early-out. The pointer-only key used to be backed by an explicit width check in the deduplication, which commit 1e3c49aa03fb ("lib/fonts: Compare font data for equality with font_data_is_equal()") dropped. Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap") Cc: stable@vger.kernel.org Signed-off-by: Yao Yiqi Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller Signed-off-by: Sasha Levin --- drivers/video/fbdev/core/fbcon.h | 9 ++++++--- drivers/video/fbdev/core/fbcon_rotate.c | 9 ++++++++- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h index 407d207b14f16..bfbd70f8b1cdf 100644 --- a/drivers/video/fbdev/core/fbcon.h +++ b/drivers/video/fbdev/core/fbcon.h @@ -89,10 +89,13 @@ struct fbcon_par { char *cursor_data; #ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION struct { - font_data_t *fontdata; /* source font */ - u8 *buf; /* rotated glyphs */ + font_data_t *fontdata; /* source font */ + u8 *buf; /* rotated glyphs */ size_t bufsize; - int buf_rotate; /* rotation of buf */ + int buf_rotate; /* rotation of buf */ + unsigned int buf_width; /* geometry of source font */ + unsigned int buf_height; + unsigned int buf_charcount; } rotated; #endif u8 *cursor_src; diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c index 6cdbc96eeca6f..660a3fa81baed 100644 --- a/drivers/video/fbdev/core/fbcon_rotate.c +++ b/drivers/video/fbdev/core/fbcon_rotate.c @@ -21,11 +21,18 @@ int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc) unsigned char *buf; int ret; - if (par->p->fontdata == par->rotated.fontdata && par->rotate == par->rotated.buf_rotate) + if (par->p->fontdata == par->rotated.fontdata && + par->rotate == par->rotated.buf_rotate && + vc->vc_font.width == par->rotated.buf_width && + vc->vc_font.height == par->rotated.buf_height && + vc->vc_font.charcount == par->rotated.buf_charcount) return 0; par->rotated.fontdata = par->p->fontdata; par->rotated.buf_rotate = par->rotate; + par->rotated.buf_width = vc->vc_font.width; + par->rotated.buf_height = vc->vc_font.height; + par->rotated.buf_charcount = vc->vc_font.charcount; if (info->fbops->fb_sync) info->fbops->fb_sync(info); -- 2.53.0