lkml.org 
[lkml]   [2019]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 002/131] drm/vmwgfx: Dont double-free the mode stored in par->set_mode
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Thomas Zimmermann <tzimmermann@suse.de>

    commit c2d311553855395764e2e5bf401d987ba65c2056 upstream.

    When calling vmw_fb_set_par(), the mode stored in par->set_mode gets free'd
    twice. The first free is in vmw_fb_kms_detach(), the second is near the
    end of vmw_fb_set_par() under the name of 'old_mode'. The mode-setting code
    only works correctly if the mode doesn't actually change. Removing
    'old_mode' in favor of using par->set_mode directly fixes the problem.

    Cc: <stable@vger.kernel.org>
    Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2")
    Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
    Reviewed-by: Deepak Rawat <drawat@vmware.com>
    Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 +++---------
    1 file changed, 3 insertions(+), 9 deletions(-)

    --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
    @@ -531,11 +531,9 @@ static int vmw_fb_set_par(struct fb_info
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
    };
    - struct drm_display_mode *old_mode;
    struct drm_display_mode *mode;
    int ret;

    - old_mode = par->set_mode;
    mode = drm_mode_duplicate(vmw_priv->dev, &new_mode);
    if (!mode) {
    DRM_ERROR("Could not create new fb mode.\n");
    @@ -546,11 +544,7 @@ static int vmw_fb_set_par(struct fb_info
    mode->vdisplay = var->yres;
    vmw_guess_mode_timing(mode);

    - if (old_mode && drm_mode_equal(old_mode, mode)) {
    - drm_mode_destroy(vmw_priv->dev, mode);
    - mode = old_mode;
    - old_mode = NULL;
    - } else if (!vmw_kms_validate_mode_vram(vmw_priv,
    + if (!vmw_kms_validate_mode_vram(vmw_priv,
    mode->hdisplay *
    DIV_ROUND_UP(var->bits_per_pixel, 8),
    mode->vdisplay)) {
    @@ -613,8 +607,8 @@ static int vmw_fb_set_par(struct fb_info
    schedule_delayed_work(&par->local_work, 0);

    out_unlock:
    - if (old_mode)
    - drm_mode_destroy(vmw_priv->dev, old_mode);
    + if (par->set_mode)
    + drm_mode_destroy(vmw_priv->dev, par->set_mode);
    par->set_mode = mode;

    drm_modeset_unlock_all(vmw_priv->dev);

    \
     
     \ /
      Last update: 2019-04-01 19:32    [W:4.129 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site