diff options
| author | Archit Taneja | 2015-06-26 12:19:43 +0200 |
|---|---|---|
| committer | Rob Clark | 2015-08-14 23:10:13 +0200 |
| commit | 507d71b1fa91e2ea5887fcc347d5e71605e113f8 (patch) | |
| tree | 8f7349504a9f2aa14055f716497a042b55ebf31b /drivers/gpu/drm | |
| parent | drm/msm: fix msm_gem_prime_get_sg_table() (diff) | |
| download | kernel-qcow2-linux-507d71b1fa91e2ea5887fcc347d5e71605e113f8.tar.gz kernel-qcow2-linux-507d71b1fa91e2ea5887fcc347d5e71605e113f8.tar.xz kernel-qcow2-linux-507d71b1fa91e2ea5887fcc347d5e71605e113f8.zip | |
drm/msm: mdp4: Fix drm_framebuffer dereference crash
mdp4_get_frame_format() can dereference a drm_framebuffer when it's NULL.
Call it in mdp4_plane_mode_set only when we know fb is non-NULL.
Signed-off-by: Archit Taneja <architt@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Diffstat (limited to 'drivers/gpu/drm')
| -rw-r--r-- | drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c index 0d1dbb737933..247a424445f7 100644 --- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c +++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_plane.c @@ -220,13 +220,15 @@ static int mdp4_plane_mode_set(struct drm_plane *plane, uint32_t op_mode = 0; uint32_t phasex_step = MDP4_VG_PHASE_STEP_DEFAULT; uint32_t phasey_step = MDP4_VG_PHASE_STEP_DEFAULT; - enum mdp4_frame_format frame_type = mdp4_get_frame_format(fb); + enum mdp4_frame_format frame_type; if (!(crtc && fb)) { DBG("%s: disabled!", mdp4_plane->name); return 0; } + frame_type = mdp4_get_frame_format(fb); + /* src values are in Q16 fixed point, convert to integer: */ src_x = src_x >> 16; src_y = src_y >> 16; |