Commit 8b53b7fb authored by Wolfram Stering's avatar Wolfram Stering Committed by Florian Tobias Schandinat
Browse files

mx3fb: fix NULL pointer dereference in screen blanking. 



When blanking an already blanked framebuffer, a kernel NULL pointer
dereference occurred, because mx3fb driver handles all kinds of screen
blanking (normal, vsync suspend, powerdown) in the same way.
Certain programs (Xorg X11 server) first do a normal blank, followed by
a powerdown blank, which triggered the bug.

Add an additional safeguard and make sdc_disable_channel() safe against
multiple calls independent of other logic.

Signed-off-by: default avatarMichael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: default avatarFlorian Tobias Schandinat <FlorianSchandinat@gmx.de>
parent f8798ccb

drivers/video/mx3fb.c

+13 −0
Original line number Diff line number Diff line
@@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi) 
	uint32_t enabled;

	unsigned long flags;



	if (mx3_fbi->txd == NULL)

		return;



	spin_lock_irqsave(&mx3fb->lock, flags);



	enabled = sdc_fb_uninit(mx3_fbi);
@@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi) 
{

	struct mx3fb_info *mx3_fbi = fbi->par;

	struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;

	int was_blank = mx3_fbi->blank;



	mx3_fbi->blank = blank;



	/* Attention!

	 * Do not call sdc_disable_channel() for a channel that is disabled

	 * already! This will result in a kernel NULL pointer dereference

	 * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are

	 * handled equally by this driver.

	 */

	if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)

		return;



	switch (blank) {

	case FB_BLANK_POWERDOWN:

	case FB_BLANK_VSYNC_SUSPEND: