evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fbdev: sh_mobile_lcdcfb: fix more error paths

Browse source 
This patch fixes the following two erroneous error paths:

hw_usecnt is allocated with a value of 0, therefore in an early error case,
calling sh_mobile_lcdc_clk_off() will wrongly conclude, that hw_usecnt has
already been incremented. Then sh_mobile_lcdc_runtime_suspend() will be called,
which will access uninitialised data fields and crash the kernel.

sh_mobile_lcdc_stop() can be called before framebuffer has been allocated, then
ch->info is NULL and dereferencing it will Oops too.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
This commit is contained in:
Guennadi Liakhovetski 2010-09-03 07:19:57 +00:00 • committed by Paul Mundt
parent 6ee4845270
commit 5ef6b505d9
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/video/sh_mobile_lcdcfb.c
View file

@ -614,7 +614,7 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
* flush frame, and wait for frame end interrupt * flush frame, and wait for frame end interrupt
* clean up deferred io and enable clock * clean up deferred io and enable clock
*/ */
if (ch->info->fbdefio) { if (ch->info && ch->info->fbdefio) {
ch->frame_end = 0; ch->frame_end = 0;
schedule_delayed_work(&ch->info->deferred_work, 0); schedule_delayed_work(&ch->info->deferred_work, 0);
wait_event(ch->frame_end_wait, ch->frame_end); wait_event(ch->frame_end_wait, ch->frame_end);
@ -704,7 +704,6 @@ static int sh_mobile_lcdc_setup_clocks(struct platform_device *pdev,
return PTR_ERR(priv->dot_clk); return PTR_ERR(priv->dot_clk);
} }
} }
atomic_set(&priv->hw_usecnt, -1);
/* Runtime PM support involves two step for this driver: /* Runtime PM support involves two step for this driver:
* 1) Enable Runtime PM * 1) Enable Runtime PM
@ -1055,6 +1054,7 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
priv->irq = i; priv->irq = i;
pdata = pdev->dev.platform_data; pdata = pdev->dev.platform_data;
atomic_set(&priv->hw_usecnt, -1);
j = 0; j = 0;
for (i = 0; i < ARRAY_SIZE(pdata->ch); i++) { for (i = 0; i < ARRAY_SIZE(pdata->ch); i++) {