Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1394472

[PATCH 1/3] drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config()

Show all headers | View raw

During boot time, MST devices usually send a ton of hotplug events
irregardless of whether or not any physical hotplugs actually occurred.
Hotplugs mean connectors being created/destroyed, and the number of DRM
connectors changing under us. This isn't a problem if we use
fb_helper->connector_count since we only set it once in the code,
however if we use num_connector from struct drm_mode_config we risk it's
value changing under us. On top of that, there's even a chance that
dev->mode_config.num_connector != fb_helper->connector_count. If the
number of connectors happens to increase under us, we'll end up using
the wrong array size for memcpy and start writing beyond the actual
length of the array, occasionally resulting in kernel panics.

Cc: stable@vger.kernel.org
Signed-off-by: Lyude <cpaul@redhat.com>
---
 drivers/gpu/drm/i915/intel_fbdev.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 97a91e6..c607217 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -366,12 +366,12 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
 	uint64_t conn_configured = 0, mask;
 	int pass = 0;
 
-	save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool),
+	save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool),
 			       GFP_KERNEL);
 	if (!save_enabled)
 		return false;
 
-	memcpy(save_enabled, enabled, dev->mode_config.num_connector);
+	memcpy(save_enabled, enabled, fb_helper->connector_count);
 	mask = (1 << fb_helper->connector_count) - 1;
 retry:
 	for (i = 0; i < fb_helper->connector_count; i++) {
@@ -510,7 +510,7 @@ retry:
 	if (fallback) {
 bail:
 		DRM_DEBUG_KMS("Not using firmware configuration\n");
-		memcpy(enabled, save_enabled, dev->mode_config.num_connector);
+		memcpy(enabled, save_enabled, fb_helper->connector_count);
 		kfree(save_enabled);
 		return false;
 	}
-- 
2.5.5

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH 1/3] drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config() Lyude <cpaul@redhat.com> - 2016-05-04 17:40 +0200
  [PATCH 3/3] drm/fb_helper: Fix a few typos Lyude <cpaul@redhat.com> - 2016-05-04 17:40 +0200
    Re: [Intel-gfx] [PATCH 3/3] drm/fb_helper: Fix a few typos Daniel Vetter <daniel@ffwll.ch> - 2016-05-04 18:20 +0200
  [PATCH 2/3] drm/fb_helper: Fix references to dev->mode_config.num_connector Lyude <cpaul@redhat.com> - 2016-05-04 17:40 +0200
    Re: [PATCH 2/3] drm/fb_helper: Fix references to  dev->mode_config.num_connector Daniel Vetter <daniel@ffwll.ch> - 2016-05-04 19:20 +0200
      Re: [PATCH 2/3] drm/fb_helper: Fix references to  dev->mode_config.num_connector Lyude Paul <cpaul@redhat.com> - 2016-05-05 17:30 +0200
  Re: [PATCH 1/3] drm/i915/fbdev: Fix num_connector references in  intel_fb_initial_config() Daniel Vetter <daniel@ffwll.ch> - 2016-05-04 18:20 +0200

csiph-web