Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a32a3c80 authored by Laurent Pinchart's avatar Laurent Pinchart
Browse files

drm: rcar-du: Fix plane state free in plane reset handler 



The plane reset handler frees the plane state and allocates a new
default state, but when doing so attempt to free the plane state using
the base plane state pointer instead of casting it to the
driver-specific state object that has been allocated. Fix it by using
the rcar_du_plane_atomic_destroy_state() function to destroy the plane
state instead of duplicating the code.

Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: default avatarThierry Reding <treding@nvidia.com>
parent f4f0fb79

drivers/gpu/drm/rcar-du/rcar_du_plane.c

+22 −23
Original line number Diff line number Diff line
@@ -273,29 +273,6 @@ static const struct drm_plane_helper_funcs rcar_du_plane_helper_funcs = { 
	.atomic_update = rcar_du_plane_atomic_update,

};



static void rcar_du_plane_reset(struct drm_plane *plane)

{

	struct rcar_du_plane_state *state;



	if (plane->state && plane->state->fb)

		drm_framebuffer_unreference(plane->state->fb);



	kfree(plane->state);

	plane->state = NULL;



	state = kzalloc(sizeof(*state), GFP_KERNEL);

	if (state == NULL)

		return;



	state->hwindex = -1;

	state->alpha = 255;

	state->colorkey = RCAR_DU_COLORKEY_NONE;

	state->zpos = plane->type == DRM_PLANE_TYPE_PRIMARY ? 0 : 1;



	plane->state = &state->state;

	plane->state->plane = plane;

}



static struct drm_plane_state *

rcar_du_plane_atomic_duplicate_state(struct drm_plane *plane)

{
@@ -322,6 +299,28 @@ static void rcar_du_plane_atomic_destroy_state(struct drm_plane *plane, 
	kfree(to_rcar_plane_state(state));

}



static void rcar_du_plane_reset(struct drm_plane *plane)

{

	struct rcar_du_plane_state *state;



	if (plane->state) {

		rcar_du_plane_atomic_destroy_state(plane, plane->state);

		plane->state = NULL;

	}



	state = kzalloc(sizeof(*state), GFP_KERNEL);

	if (state == NULL)

		return;



	state->hwindex = -1;

	state->alpha = 255;

	state->colorkey = RCAR_DU_COLORKEY_NONE;

	state->zpos = plane->type == DRM_PLANE_TYPE_PRIMARY ? 0 : 1;



	plane->state = &state->state;

	plane->state->plane = plane;

}



static int rcar_du_plane_atomic_set_property(struct drm_plane *plane,

					     struct drm_plane_state *state,

					     struct drm_property *property,