Attachment 123470 Details for Bug 94822 – FB Connector Patch #1

[patch] FB Connector Patch #1

0001-drm-i915-fbdev-Fix-num_connector-references-in-intel.patch (text/plain), 2.17 KB, created by Jim Bride on 2016-05-04 20:52:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jim Bride

Created: 2016-05-04 20:52:32 UTC

Size: 2.17 KB

patch

obsolete

>From e1c99e017996cd2b61eea9e324458e92a83e34e8 Mon Sep 17 00:00:00 2001
>From: Lyude <cpaul@redhat.com>
>Date: Wed, 4 May 2016 11:28:51 -0400
>Subject: [PATCH 1/3] drm/i915/fbdev: Fix num_connector references in
> intel_fb_initial_config()
>
>During boot time, MST devices usually send a ton of hotplug events
>irregardless of whether or not any physical hotplugs actually occurred.
>Hotplugs mean connectors being created/destroyed, and the number of DRM
>connectors changing under us. This isn't a problem if we use
>fb_helper->connector_count since we only set it once in the code,
>however if we use num_connector from struct drm_mode_config we risk it's
>value changing under us. On top of that, there's even a chance that
>dev->mode_config.num_connector != fb_helper->connector_count. If the
>number of connectors happens to increase under us, we'll end up using
>the wrong array size for memcpy and start writing beyond the actual
>length of the array, occasionally resulting in kernel panics.
>
>Cc: stable@vger.kernel.org
>Signed-off-by: Lyude <cpaul@redhat.com>
>---
> drivers/gpu/drm/i915/intel_fbdev.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
>index 5a101a2..99e2753 100644
>--- a/drivers/gpu/drm/i915/intel_fbdev.c
>+++ b/drivers/gpu/drm/i915/intel_fbdev.c
>@@ -370,12 +370,12 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
> 	uint64_t conn_configured = 0, mask;
> 	int pass = 0;
> 
>-	save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool),
>+	save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool),
> 			       GFP_KERNEL);
> 	if (!save_enabled)
> 		return false;
> 
>-	memcpy(save_enabled, enabled, dev->mode_config.num_connector);
>+	memcpy(save_enabled, enabled, fb_helper->connector_count);
> 	mask = (1 << fb_helper->connector_count) - 1;
> retry:
> 	for (i = 0; i < fb_helper->connector_count; i++) {
>@@ -522,7 +522,7 @@ retry:
> 	if (fallback) {
> bail:
> 		DRM_DEBUG_KMS("Not using firmware configuration\n");
>-		memcpy(enabled, save_enabled, dev->mode_config.num_connector);
>+		memcpy(enabled, save_enabled, fb_helper->connector_count);
> 		kfree(save_enabled);
> 		return false;
> 	}
>-- 
>2.7.4
>

Actions: View | Splinter Review

Attachments on bug 94822: 122705 | 123470 | 123471 | 123494 | 123495 | 123496 | 123571

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.