lkml.org 
[lkml]   [2011]   [Oct]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] mx3fb: fix NULL pointer dereference in screen blanking.
On 09/23/2011 12:09 PM, Michael Thalmeier wrote:
> From: Wolfram Stering <wolfram.stering@hale.at>
>
> When blanking an already blanked framebuffer, a kernel NULL pointer
> dereference occurred, because mx3fb driver handles all kinds of screen
> blanking (normal, vsync suspend, powerdown) in the same way.
> Certain programs (Xorg X11 server) first do a normal blank, followed by
> a powerdown blank, which triggered the bug.
>
> Add an additional safeguard and make sdc_disable_channel() safe against
> multiple calls independent of other logic.
>
> Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>

Applied.


Thanks,

Florian Tobias Schandinat

> ---
> drivers/video/mx3fb.c | 13 +++++++++++++
> 1 files changed, 13 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
> index 7e3a490..286be99 100644
> --- a/drivers/video/mx3fb.c
> +++ b/drivers/video/mx3fb.c
> @@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
> uint32_t enabled;
> unsigned long flags;
>
> + if (mx3_fbi->txd == NULL)
> + return;
> +
> spin_lock_irqsave(&mx3fb->lock, flags);
>
> enabled = sdc_fb_uninit(mx3_fbi);
> @@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
> {
> struct mx3fb_info *mx3_fbi = fbi->par;
> struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
> + int was_blank = mx3_fbi->blank;
>
> mx3_fbi->blank = blank;
>
> + /* Attention!
> + * Do not call sdc_disable_channel() for a channel that is disabled
> + * already! This will result in a kernel NULL pointer dereference
> + * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
> + * handled equally by this driver.
> + */
> + if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
> + return;
> +
> switch (blank) {
> case FB_BLANK_POWERDOWN:
> case FB_BLANK_VSYNC_SUSPEND:



\
 
 \ /
  Last update: 2011-10-04 22:25    [W:0.147 / U:0.060 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site