mx3fb: fix NULL pointer dereference in screen blanking.
When blanking an already blanked framebuffer, a kernel NULL pointer dereference occurred, because mx3fb driver handles all kinds of screen blanking (normal, vsync suspend, powerdown) in the same way. Certain programs (Xorg X11 server) first do a normal blank, followed by a powerdown blank, which triggered the bug. Add an additional safeguard and make sdc_disable_channel() safe against multiple calls independent of other logic. Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at> Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
This commit is contained in:
Родитель
f8798ccbef
Коммит
8b53b7fb57
|
@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
|
|||
uint32_t enabled;
|
||||
unsigned long flags;
|
||||
|
||||
if (mx3_fbi->txd == NULL)
|
||||
return;
|
||||
|
||||
spin_lock_irqsave(&mx3fb->lock, flags);
|
||||
|
||||
enabled = sdc_fb_uninit(mx3_fbi);
|
||||
|
@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
|
|||
{
|
||||
struct mx3fb_info *mx3_fbi = fbi->par;
|
||||
struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
|
||||
int was_blank = mx3_fbi->blank;
|
||||
|
||||
mx3_fbi->blank = blank;
|
||||
|
||||
/* Attention!
|
||||
* Do not call sdc_disable_channel() for a channel that is disabled
|
||||
* already! This will result in a kernel NULL pointer dereference
|
||||
* (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
|
||||
* handled equally by this driver.
|
||||
*/
|
||||
if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
|
||||
return;
|
||||
|
||||
switch (blank) {
|
||||
case FB_BLANK_POWERDOWN:
|
||||
case FB_BLANK_VSYNC_SUSPEND:
|
||||
|
|
Загрузка…
Ссылка в новой задаче