path: root/drivers/video/mx3fb.c
diff options
authorWolfram Stering <wolfram.stering@hale.at>2011-09-23 14:09:35 +0200
committerFlorian Tobias Schandinat <FlorianSchandinat@gmx.de>2011-10-03 15:52:32 +0000
commit8b53b7fb57e1ce3441b1a32f8374874b53c4bc31 (patch)
treed7074d96318895062cc0bba363e4e843ff5ab560 /drivers/video/mx3fb.c
parentf8798ccbefc0e4ef7438c080b7ba0410738c8cfa (diff)
mx3fb: fix NULL pointer dereference in screen blanking.
When blanking an already blanked framebuffer, a kernel NULL pointer dereference occurred, because mx3fb driver handles all kinds of screen blanking (normal, vsync suspend, powerdown) in the same way. Certain programs (Xorg X11 server) first do a normal blank, followed by a powerdown blank, which triggered the bug. Add an additional safeguard and make sdc_disable_channel() safe against multiple calls independent of other logic. Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at> Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Diffstat (limited to 'drivers/video/mx3fb.c')
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index bd768588cf1..e3406ab3130 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
uint32_t enabled;
unsigned long flags;
+ if (mx3_fbi->txd == NULL)
+ return;
spin_lock_irqsave(&mx3fb->lock, flags);
enabled = sdc_fb_uninit(mx3_fbi);
@@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
struct mx3fb_info *mx3_fbi = fbi->par;
struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
+ int was_blank = mx3_fbi->blank;
mx3_fbi->blank = blank;
+ /* Attention!
+ * Do not call sdc_disable_channel() for a channel that is disabled
+ * already! This will result in a kernel NULL pointer dereference
+ * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
+ * handled equally by this driver.
+ */
+ if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
+ return;
switch (blank) {