drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up
Subsystems (3)
Thomas Zimmermann
maintainerPATCH 1/1 drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up
In the Cirrus driver, the regular clean-up code also performs the clean-up of a failed initialization. If the fbdev's framebuffer was not initialized, the clean-up will fail within drm_framebuffer_unregister_private. Booting with cirrus.bpp=16 triggers this bug.
The framebuffer is currently stored directly within struct cirrus_fbdev. To fix the bug, we turn it into a pointer that is only set for initialized framebuffers. The fbdev's clean-up code skips uninitialized framebuffers.
The memory for struct drm_framebuffer is allocated dynamically. This requires additional error handling within cirrusfb_create. The framebuffer clean-up is now performed by drm_framebuffer_put, which also frees the data strcuture's memory.
--- drivers/gpu/drm/cirrus/cirrus_drv.h | 2 +- drivers/gpu/drm/cirrus/cirrus_fbdev.c | 48 +++++++++++++++------------ drivers/gpu/drm/cirrus/cirrus_mode.c | 2 +- 3 files changed, 29 insertions(+), 23 deletions(-)
drivers/gpu/drm/cirrus/cirrus_drv.h +1 -1
@@ -146,7 +146,7 @@ struct cirrus_device {struct cirrus_fbdev {struct drm_fb_helper helper; -struct drm_framebuffer gfb; +struct drm_framebuffer *gfb;void *sysram;int size;int x1, y1, x2, y2;/* dirty rect */
drivers/gpu/drm/cirrus/cirrus_fbdev.c +27 -21
95 lines not on this page · raw message
drivers/gpu/drm/cirrus/cirrus_mode.c +1 -1
@@ -127,7 +127,7 @@ static int cirrus_crtc_do_set_base(struct drm_crtc *crtc,return ret; } -if (&cdev->mode_info.gfbdev->gfb == crtc->primary->fb) { +if (cdev->mode_info.gfbdev->gfb == crtc->primary->fb) {/* if pushing console in kmap it */ ret =ttm_bo_kmap (&bo->bo,0 , bo->bo.num_pages, &bo->kmap);if (ret)
Signature · 6 lines
2.18.0 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
Gerd Hoffmann
AppliedQuoted 5 lines · Thomas Zimmermann
In the Cirrus driver, the regular clean-up code also performs the clean-up of a failed initialization. If the fbdev's framebuffer was not initialized, the clean-up will fail within
drm_framebuffer_unregister_private. Booting with cirrus.bpp=16 triggers this bug.
Quoted 8 lines
The framebuffer is currently stored directly within struct
cirrus_fbdev. To fix the bug, we turn it into a pointer that is only set for initialized framebuffers. The fbdev's clean-up code skips uninitialized framebuffers.The memory for struct
drm_framebufferis allocated dynamically. This requires additional error handling withincirrusfb_create. The framebuffer clean-up is now performed bydrm_framebuffer_put, which also frees the data strcuture's memory.
pushed to drm-misc-next (also the other ones, except the failing ttm_put patches).
thanks,
Gerd
Gerd Hoffmann
AppliedQuoted 5 lines · Thomas Zimmermann
In the Cirrus driver, the regular clean-up code also performs the clean-up of a failed initialization. If the fbdev's framebuffer was not initialized, the clean-up will fail within
drm_framebuffer_unregister_private. Booting with cirrus.bpp=16 triggers this bug.
Quoted 8 lines
The framebuffer is currently stored directly within struct
cirrus_fbdev. To fix the bug, we turn it into a pointer that is only set for initialized framebuffers. The fbdev's clean-up code skips uninitialized framebuffers.The memory for struct
drm_framebufferis allocated dynamically. This requires additional error handling withincirrusfb_create. The framebuffer clean-up is now performed bydrm_framebuffer_put, which also frees the data strcuture's memory.
pushed to drm-misc-next (also the other ones, except the failing ttm_put patches).
thanks,
Gerd
_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel