2017-01-28 15:01 GMT-02:00 Marek Vasut <[email protected]>: > > The mxsfb driver will crash if the mxsfb DT node has a subnode, > but the content of the subnode is not of-graph binding with an > endpoint linking to panel. The crash was triggered by providing > old-style panel bindings to the mxsfb driver instead of the new > of-graph ones. > > The problem happens in mxsfb_create_output(), which is invoked > from mxsfb_load(). The mxsfb_create_output() iterates over all > mxsfb DT subnode endpoints and tries to bind a panel on each > endpoint. If there is any problem binding the panel, that is, > mxsfb->panel == NULL, this function will return an error code, > otherwise success 0 is returned. > > If the subnodes do not specify of-graph binding with an endpoint, > the iteration over endpoints in mxsfb_create_output() will have > zero cycles and the function will immediatelly return 0, but the > mxsfb->panel will remain NULL. This is propagated back into the > mxsfb_load(), which does not detect any problem and expects that > the mxsfb->panel is valid, thus calls mxsfb_panel_attach(). But > since mxsfb->panel == NULL, mxsfb_panel_attach() is called with > first argument NULL and this crashes the kernel. > > This patch fixes the problem by explicitly checking for valid > mxsfb->panel at the end of the iteration in mxsfb_create_output(). > > Signed-off-by: Marek Vasut <[email protected]> > Cc: Daniel Vetter <[email protected]> > Cc: Dave Airlie <[email protected]> > Cc: Stefan Agner <[email protected]> > Cc: Breno Matheus Lima <[email protected]>
Tested-by: Breno Lima <[email protected]>
_______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
