From 662394fb30fdbcc89ec387918714aebee6868a9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= Date: Wed, 4 Sep 2019 19:01:23 +0200 Subject: brcm2708: update to latest patches from RPi foundation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Álvaro Fernández Rojas --- ...-NULL-pointer-dereference-in-the-async-up.patch | 57 ---------------------- 1 file changed, 57 deletions(-) delete mode 100644 target/linux/brcm2708/patches-4.19/950-0762-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch (limited to 'target/linux/brcm2708/patches-4.19/950-0762-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch') diff --git a/target/linux/brcm2708/patches-4.19/950-0762-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch b/target/linux/brcm2708/patches-4.19/950-0762-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch deleted file mode 100644 index 27bc30b005..0000000000 --- a/target/linux/brcm2708/patches-4.19/950-0762-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 8f73c4a08531d65fc4ce12d9a61deb16a7d601cb Mon Sep 17 00:00:00 2001 -From: Boris Brezillon -Date: Thu, 15 Nov 2018 11:58:51 +0100 -Subject: [PATCH 762/773] drm/vc4: Fix NULL pointer dereference in the async - update path - -vc4_plane_atomic_async_update() calls vc4_plane_atomic_check() -which in turn calls vc4_plane_setup_clipping_and_scaling(), and since -commit 58a6a36fe8e0 ("drm/vc4: Use -drm_atomic_helper_check_plane_state() to simplify the logic"), this -function accesses plane_state->state which will be NULL when called -from the async update path because we're passing the current plane -state, and plane_state->state has been assigned to NULL in -drm_atomic_helper_swap_state(). - -Pass the new state instead of the current one (the new state has -->state set to a non-NULL value). - -Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic") -Signed-off-by: Boris Brezillon -Reviewed-by: Eric Anholt -Link: https://patchwork.freedesktop.org/patch/msgid/20181115105852.9844-1-boris.brezillon@bootlin.com ---- - drivers/gpu/drm/vc4/vc4_plane.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - ---- a/drivers/gpu/drm/vc4/vc4_plane.c -+++ b/drivers/gpu/drm/vc4/vc4_plane.c -@@ -905,7 +905,7 @@ void vc4_plane_async_set_fb(struct drm_p - static void vc4_plane_atomic_async_update(struct drm_plane *plane, - struct drm_plane_state *state) - { -- struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state); -+ struct vc4_plane_state *vc4_state, *new_vc4_state; - - if (plane->state->fb != state->fb) { - vc4_plane_async_set_fb(plane, state->fb); -@@ -927,7 +927,18 @@ static void vc4_plane_atomic_async_updat - plane->state->src_y = state->src_y; - - /* Update the display list based on the new crtc_x/y. */ -- vc4_plane_atomic_check(plane, plane->state); -+ vc4_plane_atomic_check(plane, state); -+ -+ new_vc4_state = to_vc4_plane_state(state); -+ vc4_state = to_vc4_plane_state(plane->state); -+ -+ /* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */ -+ vc4_state->dlist[vc4_state->pos0_offset] = -+ new_vc4_state->dlist[vc4_state->pos0_offset]; -+ vc4_state->dlist[vc4_state->pos2_offset] = -+ new_vc4_state->dlist[vc4_state->pos2_offset]; -+ vc4_state->dlist[vc4_state->ptr0_offset] = -+ new_vc4_state->dlist[vc4_state->ptr0_offset]; - - /* Note that we can't just call vc4_plane_write_dlist() - * because that would smash the context data that the HVS is -- cgit v1.2.3