Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ef6b505 authored by Guennadi Liakhovetski's avatar Guennadi Liakhovetski Committed by Paul Mundt
Browse files

fbdev: sh_mobile_lcdcfb: fix more error paths 



This patch fixes the following two erroneous error paths:

hw_usecnt is allocated with a value of 0, therefore in an early error case,
calling sh_mobile_lcdc_clk_off() will wrongly conclude, that hw_usecnt has
already been incremented. Then sh_mobile_lcdc_runtime_suspend() will be called,
which will access uninitialised data fields and crash the kernel.

sh_mobile_lcdc_stop() can be called before framebuffer has been allocated, then
ch->info is NULL and dereferencing it will Oops too.

Signed-off-by: default avatarGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: default avatarPaul Mundt <lethal@linux-sh.org>
parent 6ee48452

drivers/video/sh_mobile_lcdcfb.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -614,7 +614,7 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv) 
		 * flush frame, and wait for frame end interrupt

		 * flush frame, and wait for frame end interrupt

		 * clean up deferred io and enable clock

		 * clean up deferred io and enable clock

		 */

		 */

		if (ch->info->fbdefio) {

		if (ch->info && ch->info->fbdefio) {

			ch->frame_end = 0;

			ch->frame_end = 0;

			schedule_delayed_work(&ch->info->deferred_work, 0);

			schedule_delayed_work(&ch->info->deferred_work, 0);

			wait_event(ch->frame_end_wait, ch->frame_end);

			wait_event(ch->frame_end_wait, ch->frame_end);
@@ -704,7 +704,6 @@ static int sh_mobile_lcdc_setup_clocks(struct platform_device *pdev, 
			return PTR_ERR(priv->dot_clk);

			return PTR_ERR(priv->dot_clk);

		}

		}

	}

	}

	atomic_set(&priv->hw_usecnt, -1);





	/* Runtime PM support involves two step for this driver:

	/* Runtime PM support involves two step for this driver:

	 * 1) Enable Runtime PM

	 * 1) Enable Runtime PM
@@ -1055,6 +1054,7 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev) 




	priv->irq = i;

	priv->irq = i;

	pdata = pdev->dev.platform_data;

	pdata = pdev->dev.platform_data;

	atomic_set(&priv->hw_usecnt, -1);





	j = 0;

	j = 0;

	for (i = 0; i < ARRAY_SIZE(pdata->ch); i++) {

	for (i = 0; i < ARRAY_SIZE(pdata->ch); i++) {