From: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
To: Michael Thalmeier <michael.thalmeier@hale.at>
Cc: linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mx3fb: fix NULL pointer dereference in screen blanking.
Date: Tue, 04 Oct 2011 20:22:02 +0000 [thread overview]
Message-ID: <4E8B6AEA.2060608@gmx.de> (raw)
In-Reply-To: <1316779775-12730-1-git-send-email-michael.thalmeier@hale.at>
On 09/23/2011 12:09 PM, Michael Thalmeier wrote:
> From: Wolfram Stering <wolfram.stering@hale.at>
>
> When blanking an already blanked framebuffer, a kernel NULL pointer
> dereference occurred, because mx3fb driver handles all kinds of screen
> blanking (normal, vsync suspend, powerdown) in the same way.
> Certain programs (Xorg X11 server) first do a normal blank, followed by
> a powerdown blank, which triggered the bug.
>
> Add an additional safeguard and make sdc_disable_channel() safe against
> multiple calls independent of other logic.
>
> Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Applied.
Thanks,
Florian Tobias Schandinat
> ---
> drivers/video/mx3fb.c | 13 +++++++++++++
> 1 files changed, 13 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
> index 7e3a490..286be99 100644
> --- a/drivers/video/mx3fb.c
> +++ b/drivers/video/mx3fb.c
> @@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
> uint32_t enabled;
> unsigned long flags;
>
> + if (mx3_fbi->txd = NULL)
> + return;
> +
> spin_lock_irqsave(&mx3fb->lock, flags);
>
> enabled = sdc_fb_uninit(mx3_fbi);
> @@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
> {
> struct mx3fb_info *mx3_fbi = fbi->par;
> struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
> + int was_blank = mx3_fbi->blank;
>
> mx3_fbi->blank = blank;
>
> + /* Attention!
> + * Do not call sdc_disable_channel() for a channel that is disabled
> + * already! This will result in a kernel NULL pointer dereference
> + * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
> + * handled equally by this driver.
> + */
> + if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
> + return;
> +
> switch (blank) {
> case FB_BLANK_POWERDOWN:
> case FB_BLANK_VSYNC_SUSPEND:
WARNING: multiple messages have this Message-ID (diff)
From: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
To: Michael Thalmeier <michael.thalmeier@hale.at>
Cc: linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mx3fb: fix NULL pointer dereference in screen blanking.
Date: Tue, 04 Oct 2011 20:22:02 +0000 [thread overview]
Message-ID: <4E8B6AEA.2060608@gmx.de> (raw)
In-Reply-To: <1316779775-12730-1-git-send-email-michael.thalmeier@hale.at>
On 09/23/2011 12:09 PM, Michael Thalmeier wrote:
> From: Wolfram Stering <wolfram.stering@hale.at>
>
> When blanking an already blanked framebuffer, a kernel NULL pointer
> dereference occurred, because mx3fb driver handles all kinds of screen
> blanking (normal, vsync suspend, powerdown) in the same way.
> Certain programs (Xorg X11 server) first do a normal blank, followed by
> a powerdown blank, which triggered the bug.
>
> Add an additional safeguard and make sdc_disable_channel() safe against
> multiple calls independent of other logic.
>
> Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Applied.
Thanks,
Florian Tobias Schandinat
> ---
> drivers/video/mx3fb.c | 13 +++++++++++++
> 1 files changed, 13 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
> index 7e3a490..286be99 100644
> --- a/drivers/video/mx3fb.c
> +++ b/drivers/video/mx3fb.c
> @@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
> uint32_t enabled;
> unsigned long flags;
>
> + if (mx3_fbi->txd == NULL)
> + return;
> +
> spin_lock_irqsave(&mx3fb->lock, flags);
>
> enabled = sdc_fb_uninit(mx3_fbi);
> @@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
> {
> struct mx3fb_info *mx3_fbi = fbi->par;
> struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
> + int was_blank = mx3_fbi->blank;
>
> mx3_fbi->blank = blank;
>
> + /* Attention!
> + * Do not call sdc_disable_channel() for a channel that is disabled
> + * already! This will result in a kernel NULL pointer dereference
> + * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
> + * handled equally by this driver.
> + */
> + if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
> + return;
> +
> switch (blank) {
> case FB_BLANK_POWERDOWN:
> case FB_BLANK_VSYNC_SUSPEND:
next prev parent reply other threads:[~2011-10-04 20:22 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-09-23 12:09 [PATCH] mx3fb: fix NULL pointer dereference in screen blanking Michael Thalmeier
2011-09-23 12:09 ` Michael Thalmeier
2011-10-04 20:22 ` Florian Tobias Schandinat [this message]
2011-10-04 20:22 ` Florian Tobias Schandinat
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E8B6AEA.2060608@gmx.de \
--to=florianschandinat@gmx.de \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=michael.thalmeier@hale.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.