aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch
diff options
context:
space:
mode:
authorAdrian Schmutzler <freifunk@adrianschmutzler.de>2020-02-08 21:58:55 +0100
committerAdrian Schmutzler <freifunk@adrianschmutzler.de>2020-02-14 14:10:51 +0100
commit7d7aa2fd924c27829ec25f825481554dd81bce97 (patch)
tree658b87b89331670266163e522ea5fb52535633cb /target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch
parente7bfda2c243e66a75ff966ba04c28b1590b5d24c (diff)
downloadupstream-7d7aa2fd924c27829ec25f825481554dd81bce97.tar.gz
upstream-7d7aa2fd924c27829ec25f825481554dd81bce97.tar.bz2
upstream-7d7aa2fd924c27829ec25f825481554dd81bce97.zip
brcm2708: rename target to bcm27xx
This change makes the names of Broadcom targets consistent by using the common notation based on SoC/CPU ID (which is used internally anyway), bcmXXXX instead of brcmXXXX. This is even used for target TITLE in make menuconfig already, only the short target name used brcm so far. Despite, since subtargets range from bcm2708 to bcm2711, it seems appropriate to use bcm27xx instead of bcm2708 (again, as already done for BOARDNAME). This also renames the packages brcm2708-userland and brcm2708-gpu-fw. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> Acked-by: Álvaro Fernández Rojas <noltari@gmail.com>
Diffstat (limited to 'target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch')
-rw-r--r--target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch57
1 files changed, 57 insertions, 0 deletions
diff --git a/target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch b/target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch
new file mode 100644
index 0000000000..c9e779878b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch
@@ -0,0 +1,57 @@
+From 0e81807e647c5e12fd897f3d520252ea60de3ff9 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+Date: Thu, 15 Nov 2018 11:58:51 +0100
+Subject: [PATCH] drm/vc4: Fix NULL pointer dereference in the async
+ update path
+
+vc4_plane_atomic_async_update() calls vc4_plane_atomic_check()
+which in turn calls vc4_plane_setup_clipping_and_scaling(), and since
+commit 58a6a36fe8e0 ("drm/vc4: Use
+drm_atomic_helper_check_plane_state() to simplify the logic"), this
+function accesses plane_state->state which will be NULL when called
+from the async update path because we're passing the current plane
+state, and plane_state->state has been assigned to NULL in
+drm_atomic_helper_swap_state().
+
+Pass the new state instead of the current one (the new state has
+->state set to a non-NULL value).
+
+Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic")
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181115105852.9844-1-boris.brezillon@bootlin.com
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -905,7 +905,7 @@ void vc4_plane_async_set_fb(struct drm_p
+ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
+ struct drm_plane_state *state)
+ {
+- struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
++ struct vc4_plane_state *vc4_state, *new_vc4_state;
+
+ if (plane->state->fb != state->fb) {
+ vc4_plane_async_set_fb(plane, state->fb);
+@@ -927,7 +927,18 @@ static void vc4_plane_atomic_async_updat
+ plane->state->src_y = state->src_y;
+
+ /* Update the display list based on the new crtc_x/y. */
+- vc4_plane_atomic_check(plane, plane->state);
++ vc4_plane_atomic_check(plane, state);
++
++ new_vc4_state = to_vc4_plane_state(state);
++ vc4_state = to_vc4_plane_state(plane->state);
++
++ /* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
++ vc4_state->dlist[vc4_state->pos0_offset] =
++ new_vc4_state->dlist[vc4_state->pos0_offset];
++ vc4_state->dlist[vc4_state->pos2_offset] =
++ new_vc4_state->dlist[vc4_state->pos2_offset];
++ vc4_state->dlist[vc4_state->ptr0_offset] =
++ new_vc4_state->dlist[vc4_state->ptr0_offset];
+
+ /* Note that we can't just call vc4_plane_write_dlist()
+ * because that would smash the context data that the HVS is