dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

mx3fb: fix NULL pointer dereference in screen blanking. 

When blanking an already blanked framebuffer, a kernel NULL pointer
dereference occurred, because mx3fb driver handles all kinds of screen
blanking (normal, vsync suspend, powerdown) in the same way.
Certain programs (Xorg X11 server) first do a normal blank, followed by
a powerdown blank, which triggered the bug.

Add an additional safeguard and make sdc_disable_channel() safe against
multiple calls independent of other logic.

Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
This commit is contained in:
Wolfram Stering 2011-09-23 14:09:35 +02:00 committed by Florian Tobias Schandinat
parent f8798ccbef
commit 8b53b7fb57
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/video/mx3fb.c
View File

@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
uint32_t enabled;
unsigned long flags;
if (mx3_fbi->txd == NULL)
return;
spin_lock_irqsave(&mx3fb->lock, flags);
enabled = sdc_fb_uninit(mx3_fbi);
@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
{
struct mx3fb_info *mx3_fbi = fbi->par;
struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
int was_blank = mx3_fbi->blank;
mx3_fbi->blank = blank;
/* Attention!
* Do not call sdc_disable_channel() for a channel that is disabled
* already! This will result in a kernel NULL pointer dereference
* (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
* handled equally by this driver.
*/
if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
return;
switch (blank) {
case FB_BLANK_POWERDOWN:
case FB_BLANK_VSYNC_SUSPEND: