Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-07 20:51:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

drm: rcar-du: Fix crash with groups that have less than 9 planes

Browse Source 
Commit 917de18037 ("drm: rcar-du: Implement universal plane support")
made the number of planes per group dynamic, but didn't update all loops
over the planes array, resulting in out-of-bound accesses on DU
instances that have an odd number of CRTCs (such as the R8A7790). Fix
it.

Fixes: 917de18037 ("drm: rcar-du: Implement universal plane support")
Cc: stable@vger.kernel.org
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
This commit is contained in:
Laurent Pinchart 2015-05-25 16:32:45 +03:00
parent 911316fe2f
commit d6aed57481
4 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/rcar-du/rcar_du_crtc.c
View File

@ -214,7 +214,7 @@ static void rcar_du_crtc_update_planes(struct rcar_du_crtc *rcrtc)
unsigned int i;
u32 dspr = 0;
for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) {
for (i = 0; i < rcrtc->group->num_planes; ++i) {
struct rcar_du_plane *plane = &rcrtc->group->planes[i];
unsigned int j;
@ -445,7 +445,7 @@ void rcar_du_crtc_resume(struct rcar_du_crtc *rcrtc)
rcar_du_crtc_start(rcrtc);
/* Commit the planes state. */
for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) {
for (i = 0; i < rcrtc->group->num_planes; ++i) {
struct rcar_du_plane *plane = &rcrtc->group->planes[i];
if (plane->plane.state->crtc != &rcrtc->crtc)

2
drivers/gpu/drm/rcar-du/rcar_du_group.h
View File

@ -30,6 +30,7 @@ struct rcar_du_device;
* @used_crtcs: number of CRTCs currently in use
* @lock: protects the dptsr_planes field and the DPTSR register
* @dptsr_planes: bitmask of planes driven by dot-clock and timing generator 1
* @num_planes: number of planes in the group
* @planes: planes handled by the group
*/
struct rcar_du_group {
@ -44,6 +45,7 @@ struct rcar_du_group {
struct mutex lock;
unsigned int dptsr_planes;
unsigned int num_planes;
struct rcar_du_plane planes[RCAR_DU_NUM_KMS_PLANES];
};

2
drivers/gpu/drm/rcar-du/rcar_du_kms.c
View File

@ -336,7 +336,7 @@ static int rcar_du_atomic_check(struct drm_device *dev,
dev_dbg(rcdu->dev, "%s: finding free planes for group %u\n",
__func__, index);
for (i = 0; i < RCAR_DU_NUM_KMS_PLANES; ++i) {
for (i = 0; i < group->num_planes; ++i) {
struct rcar_du_plane *plane = &group->planes[i];
struct rcar_du_plane_state *plane_state;
struct drm_plane_state *s;

5
drivers/gpu/drm/rcar-du/rcar_du_plane.c
View File

@ -390,7 +390,6 @@ static const uint32_t formats[] = {
int rcar_du_planes_init(struct rcar_du_group *rgrp)
{
struct rcar_du_device *rcdu = rgrp->dev;
unsigned int num_planes;
unsigned int crtcs;
unsigned int i;
int ret;
@ -398,11 +397,11 @@ int rcar_du_planes_init(struct rcar_du_group *rgrp)
/* Create one primary plane per CRTC in this group and seven overlay
* planes.
*/
num_planes = rgrp->num_crtcs + 7;
rgrp->num_planes = rgrp->num_crtcs + 7;
crtcs = ((1 << rcdu->num_crtcs) - 1) & (3 << (2 * rgrp->index));
for (i = 0; i < num_planes; ++i) {
for (i = 0; i < rgrp->num_planes; ++i) {
enum drm_plane_type type = i < rgrp->num_crtcs
? DRM_PLANE_TYPE_PRIMARY
: DRM_PLANE_TYPE_OVERLAY;