hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID5JM1 CVE: NA ------------------ This reverts commit 7389066b79d5dc829e15de2509e43a66bf24e296. This patch caused an issue which a virtual machine could not start, revert it. Fixes: 7389066b79d5 ("fbdev: Fix out-of-bounds issue in sys_fillrect()") Signed-off-by: Gu Bowen <gubowen5@huawei.com> --- drivers/video/fbdev/core/fbcon.c | 2 +- drivers/video/fbdev/core/sysfillrect.c | 6 ------ 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index e893835c1c25..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2649,9 +2649,9 @@ static void fbcon_modechanged(struct fb_info *info) return; p = &fb_display[vc->vc_num]; + set_blitting_type(vc, info); if (con_is_visible(vc)) { - set_blitting_type(vc, info); var_to_display(p, &info->var, info); cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); diff --git a/drivers/video/fbdev/core/sysfillrect.c b/drivers/video/fbdev/core/sysfillrect.c index 7b4103c3288e..33ee3d34f9d2 100644 --- a/drivers/video/fbdev/core/sysfillrect.c +++ b/drivers/video/fbdev/core/sysfillrect.c @@ -248,7 +248,6 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) u32 bpp = p->var.bits_per_pixel; unsigned long *dst; int dst_idx, left; - long dst_offset; if (p->state != FBINFO_STATE_RUNNING) return; @@ -288,11 +287,6 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) } while (height--) { dst += dst_idx >> (ffs(bits) - 1); - dst_offset = (long)dst - (long)p->screen_base; - if (dst_offset < 0 || dst_offset >= p->fix.smem_len) { - pr_err("dst offset out of bound: dst_offset(%ld)", dst_offset); - return; - } dst_idx &= (bits - 1); fill_op32(p, dst, dst_idx, pat, width*bpp, bits); dst_idx += p->fix.line_length*8; -- 2.43.0