Attachment 123471 Details for Bug 94822 – FB Connector Patch #2

[patch] FB Connector Patch #2

0002-drm-fb_helper-Fix-references-to-dev-mode_config.num_.patch (text/plain), 1.95 KB, created by Jim Bride on 2016-05-04 20:53:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jim Bride

Created: 2016-05-04 20:53:05 UTC

Size: 1.95 KB

patch

obsolete

>From 7e1aaa57925056dbdde31ac4333ba14104ca7f32 Mon Sep 17 00:00:00 2001
>From: Lyude <cpaul@redhat.com>
>Date: Wed, 4 May 2016 11:28:52 -0400
>Subject: [PATCH 2/3] drm/fb_helper: Fix references to
> dev->mode_config.num_connector
>
>During boot, MST hotplugs are generally expected (even if no physical
>hotplugging occurs) and result in DRM's connector topology changing.
>This means that using num_connector from the current mode configuration
>can lead to the number of connectors changing under us. This can lead to
>some nasty scenarios in fbcon:
>
>- We allocate an array to the size of dev->mode_config.num_connectors.
>- MST hotplug occurs, dev->mode_config.num_connectors gets incremented.
>- We try to loop through each element in the array using the new value
>  of dev->mode_config.num_connectors, and end up going out of bounds
>  since dev->mode_config.num_connectors is now larger then the array we
>  allocated.
>
>fb_helper->connector_count however, will always remain consistent while
>we do a modeset in fb_helper.
>
>Cc: stable@vger.kernel.org
>Signed-off-by: Lyude <cpaul@redhat.com>
>---
> drivers/gpu/drm/drm_fb_helper.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
>index 62f849f..641d606 100644
>--- a/drivers/gpu/drm/drm_fb_helper.c
>+++ b/drivers/gpu/drm/drm_fb_helper.c
>@@ -2015,7 +2015,7 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
> 	if (modes[n] == NULL)
> 		return best_score;
> 
>-	crtcs = kzalloc(dev->mode_config.num_connector *
>+	crtcs = kzalloc(fb_helper->connector_count *
> 			sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL);
> 	if (!crtcs)
> 		return best_score;
>@@ -2061,7 +2061,7 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper,
> 		if (score > best_score) {
> 			best_score = score;
> 			memcpy(best_crtcs, crtcs,
>-			       dev->mode_config.num_connector *
>+			       fb_helper->connector_count *
> 			       sizeof(struct drm_fb_helper_crtc *));
> 		}
> 	}
>-- 
>2.7.4
>

Actions: View | Splinter Review

Attachments on bug 94822: 122705 | 123470 | 123471 | 123494 | 123495 | 123496 | 123571

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.