Skip to contentSkip to conversation

FAILED: patch "[PATCH] drm: rcar-du: Fix crash with groups that have less than 9" failed to apply to 4.1-stable tree

PATCH [email protected] 1 participant 1 message Jul 30, 2015

Subsystems (4)
Stable branch DRM drivers DRM misc Arm/RISC-V/Renesas architecture
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From d6aed57481c5b746f91792c8a977f537c09e52c5 Mon Sep 17 00:00:00 2001

From: Laurent Pinchart <[email protected]>
Date: Mon, 25 May 2015 16:32:45 +0300
Subject: [PATCH] drm: rcar-du: Fix crash with groups that have less than 9
planes

Commit 917de180379d ("drm: rcar-du: Implement universal plane support") made the number of planes per group dynamic, but didn't update all loops over the planes array, resulting in out-of-bound accesses on DU instances that have an odd number of CRTCs (such as the R8A7790). Fix it.

Fixes 917de180379d ("drm: rcar-du: Implement universal plane support")
Cc [email protected]
Signed-off-by Laurent Pinchart <[email protected]>
drivers/gpu/drm/rcar-du/rcar_du_crtc.c +2 -2
index a40085806f5b..65d6ba6621ac 100644
@@ -214,7 +214,7 @@ static void rcar_du_crtc_update_planes(struct rcar_du_crtc *rcrtc)
 	unsigned int i;
 	u32 dspr = 0;
 
-	for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) {
+	for (i = 0; i < rcrtc->group->num_planes; ++i) {
 		struct rcar_du_plane *plane = &rcrtc->group->planes[i];
 		unsigned int j;
 

@@ -445,7 +445,7 @@ void rcar_du_crtc_resume(struct rcar_du_crtc *rcrtc)
 	rcar_du_crtc_start(rcrtc);
 
 	/* Commit the planes state. */
-	for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) {
+	for (i = 0; i < rcrtc->group->num_planes; ++i) {
 		struct rcar_du_plane *plane = &rcrtc->group->planes[i];
 
 		if (plane->plane.state->crtc != &rcrtc->crtc)
drivers/gpu/drm/rcar-du/rcar_du_group.h +2 -0
index 7b414b31c3be..d7318e1a6b00 100644
@@ -30,6 +30,7 @@ struct rcar_du_device;
  * @used_crtcs: number of CRTCs currently in use
  * @lock: protects the dptsr_planes field and the DPTSR register
  * @dptsr_planes: bitmask of planes driven by dot-clock and timing generator 1
+ * @num_planes: number of planes in the group
  * @planes: planes handled by the group
  */
 struct rcar_du_group {

@@ -44,6 +45,7 @@ struct rcar_du_group {
 	struct mutex lock;
 	unsigned int dptsr_planes;
 
+	unsigned int num_planes;
 	struct rcar_du_plane planes[RCAR_DU_NUM_KMS_PLANES];
 };
drivers/gpu/drm/rcar-du/rcar_du_kms.c +1 -1
index 20859aae882e..4bb5af4bc474 100644
@@ -336,7 +336,7 @@ static int rcar_du_atomic_check(struct drm_device *dev,
 		dev_dbg(rcdu->dev, "%s: finding free planes for group %u\n",
 			__func__, index);
 
-		for (i = 0; i < RCAR_DU_NUM_KMS_PLANES; ++i) {
+		for (i = 0; i < group->num_planes; ++i) {
 			struct rcar_du_plane *plane = &group->planes[i];
 			struct rcar_du_plane_state *plane_state;
 			struct drm_plane_state *s;
drivers/gpu/drm/rcar-du/rcar_du_plane.c +2 -3
index 3e30d84b798f..d90dc428e3fd 100644
@@ -390,7 +390,6 @@ static const uint32_t formats[] = {
 int rcar_du_planes_init(struct rcar_du_group *rgrp)
 {
 	struct rcar_du_device *rcdu = rgrp->dev;
-	unsigned int num_planes;
 	unsigned int crtcs;
 	unsigned int i;
 	int ret;

@@ -398,11 +397,11 @@ int rcar_du_planes_init(struct rcar_du_group *rgrp)
 	 /* Create one primary plane per CRTC in this group and seven overlay
 	  * planes.
 	  */
-	num_planes = rgrp->num_crtcs + 7;
+	rgrp->num_planes = rgrp->num_crtcs + 7;
 
 	crtcs = ((1 << rcdu->num_crtcs) - 1) & (3 << (2 * rgrp->index));
 
-	for (i = 0; i < num_planes; ++i) {
+	for (i = 0; i < rgrp->num_planes; ++i) {
 		enum drm_plane_type type = i < rgrp->num_crtcs
 					 ? DRM_PLANE_TYPE_PRIMARY
 					 : DRM_PLANE_TYPE_OVERLAY;