Patch "fbdev: Fix sys_imageblit() for arbitrary image widths" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    fbdev: Fix sys_imageblit() for arbitrary image widths

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fbdev-fix-sys_imageblit-for-arbitrary-image-widths.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 149285a665612583506df690fa0a3d6eef12c2f9
Author: Thomas Zimmermann <tzimmermann@xxxxxxx>
Date:   Sun Mar 13 20:29:51 2022 +0100

    fbdev: Fix sys_imageblit() for arbitrary image widths
    
    [ Upstream commit 61bfcb6a3b981e8f19e044ac8c3de6edbe6caf70 ]
    
    Commit 6f29e04938bf ("fbdev: Improve performance of sys_imageblit()")
    broke sys_imageblit() for image width that are not aligned to 8-bit
    boundaries. Fix this by handling the trailing pixels on each line
    separately. The performance improvements in the original commit do not
    regress by this change.
    
    Signed-off-by: Thomas Zimmermann <tzimmermann@xxxxxxx>
    Fixes: 6f29e04938bf ("fbdev: Improve performance of sys_imageblit()")
    Reviewed-by: Javier Martinez Canillas <javierm@xxxxxxxxxx>
    Acked-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
    Tested-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
    Cc: Thomas Zimmermann <tzimmermann@xxxxxxx>
    Cc: Javier Martinez Canillas <javierm@xxxxxxxxxx>
    Cc: Sam Ravnborg <sam@xxxxxxxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/20220313192952.12058-2-tzimmermann@xxxxxxx
    Stable-dep-of: c2d22806aecb ("fbdev: fix potential OOB read in fast_imageblit()")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/video/fbdev/core/sysimgblt.c b/drivers/video/fbdev/core/sysimgblt.c
index 722c327a381bd..335e92b813fc4 100644
--- a/drivers/video/fbdev/core/sysimgblt.c
+++ b/drivers/video/fbdev/core/sysimgblt.c
@@ -188,7 +188,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,
 {
 	u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel;
 	u32 ppw = 32/bpp, spitch = (image->width + 7)/8;
-	u32 bit_mask, eorx;
+	u32 bit_mask, eorx, shift;
 	const char *s = image->data, *src;
 	u32 *dst;
 	const u32 *tab;
@@ -229,17 +229,23 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,
 
 	for (i = image->height; i--; ) {
 		dst = dst1;
+		shift = 8;
 		src = s;
 
+		/*
+		 * Manually unroll the per-line copying loop for better
+		 * performance. This works until we processed the last
+		 * completely filled source byte (inclusive).
+		 */
 		switch (ppw) {
 		case 4: /* 8 bpp */
-			for (j = k; j; j -= 2, ++src) {
+			for (j = k; j >= 2; j -= 2, ++src) {
 				*dst++ = colortab[(*src >> 4) & bit_mask];
 				*dst++ = colortab[(*src >> 0) & bit_mask];
 			}
 			break;
 		case 2: /* 16 bpp */
-			for (j = k; j; j -= 4, ++src) {
+			for (j = k; j >= 4; j -= 4, ++src) {
 				*dst++ = colortab[(*src >> 6) & bit_mask];
 				*dst++ = colortab[(*src >> 4) & bit_mask];
 				*dst++ = colortab[(*src >> 2) & bit_mask];
@@ -247,7 +253,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,
 			}
 			break;
 		case 1: /* 32 bpp */
-			for (j = k; j; j -= 8, ++src) {
+			for (j = k; j >= 8; j -= 8, ++src) {
 				*dst++ = colortab[(*src >> 7) & bit_mask];
 				*dst++ = colortab[(*src >> 6) & bit_mask];
 				*dst++ = colortab[(*src >> 5) & bit_mask];
@@ -259,6 +265,21 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,
 			}
 			break;
 		}
+
+		/*
+		 * For image widths that are not a multiple of 8, there
+		 * are trailing pixels left on the current line. Print
+		 * them as well.
+		 */
+		for (; j--; ) {
+			shift -= ppw;
+			*dst++ = colortab[(*src >> shift) & bit_mask];
+			if (!shift) {
+				shift = 8;
+				++src;
+			}
+		}
+
 		dst1 += p->fix.line_length;
 		s += spitch;
 	}



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux