viafb: use display information in info not in var for panning

As Laurent pointed out we must not use any information in the passed
var besides xoffset, yoffset and vmode as otherwise applications
might abuse it. Also use the aligned fix.line_length and not the
(possible) unaligned xres_virtual.

Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@kernel.org

1 files changed, 3 insertions, 2 deletions

diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index 3114a8755c13..aa87529d7d6a 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -348,8 +348,9 @@ static int viafb_pan_display(struct fb_var_screeninfo *var,
         struct fb_info *info)
 {
         struct viafb_par *viapar = info->par;
-        u32 vram_addr = (var->yoffset * var->xres_virtual + var->xoffset)
-                * (var->bits_per_pixel / 8) + viapar->vram_addr;
+        u32 vram_addr = viapar->vram_addr
+                + var->yoffset * info->fix.line_length
+                + var->xoffset * info->var.bits_per_pixel / 8;
 
         DEBUG_MSG(KERN_DEBUG "viafb_pan_display, address = %d\n", vram_addr);
         if (!viafb_dual_fb) {