diff options
| author | Wolfram Stering <wolfram.stering@hale.at> | 2011-09-23 14:09:35 +0200 |
|---|---|---|
| committer | Florian Tobias Schandinat <FlorianSchandinat@gmx.de> | 2011-10-03 17:52:32 +0200 |
| commit | 8b53b7fb57e1ce3441b1a32f8374874b53c4bc31 (patch) | |
| tree | d7074d96318895062cc0bba363e4e843ff5ab560 | |
| parent | video: irq: Remove IRQF_DISABLED (diff) | |
| download | linux-8b53b7fb57e1ce3441b1a32f8374874b53c4bc31.tar.xz linux-8b53b7fb57e1ce3441b1a32f8374874b53c4bc31.zip | |
mx3fb: fix NULL pointer dereference in screen blanking.
When blanking an already blanked framebuffer, a kernel NULL pointer
dereference occurred, because mx3fb driver handles all kinds of screen
blanking (normal, vsync suspend, powerdown) in the same way.
Certain programs (Xorg X11 server) first do a normal blank, followed by
a powerdown blank, which triggered the bug.
Add an additional safeguard and make sdc_disable_channel() safe against
multiple calls independent of other logic.
Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
| -rw-r--r-- | drivers/video/mx3fb.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c index bd768588cf10..e3406ab31305 100644 --- a/drivers/video/mx3fb.c +++ b/drivers/video/mx3fb.c @@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi) uint32_t enabled; unsigned long flags; + if (mx3_fbi->txd == NULL) + return; + spin_lock_irqsave(&mx3fb->lock, flags); enabled = sdc_fb_uninit(mx3_fbi); @@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi) { struct mx3fb_info *mx3_fbi = fbi->par; struct mx3fb_data *mx3fb = mx3_fbi->mx3fb; + int was_blank = mx3_fbi->blank; mx3_fbi->blank = blank; + /* Attention! + * Do not call sdc_disable_channel() for a channel that is disabled + * already! This will result in a kernel NULL pointer dereference + * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are + * handled equally by this driver. + */ + if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK) + return; + switch (blank) { case FB_BLANK_POWERDOWN: case FB_BLANK_VSYNC_SUSPEND: |