Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d1de851 authored by Thierry Reding's avatar Thierry Reding Committed by Daniel Vetter
Browse files

drm/irq: Check for valid VBLANK before dereference 



When accessing the array of per-CRTC VBLANK structures we must always
check that the index into the array is valid before dereferencing to
avoid crashing.

Signed-off-by: default avatarThierry Reding <treding@nvidia.com>
[danvet: Squash in my own whitespace ocd fixup in drm_vblank_count.]
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
parent 2a7d3d6d

drivers/gpu/drm/drm_irq.c

+9 −2
Original line number Original line Diff line number Diff line
@@ -877,6 +877,7 @@ u32 drm_vblank_count(struct drm_device *dev, int crtc) 




	if (WARN_ON(crtc >= dev->num_crtcs))

	if (WARN_ON(crtc >= dev->num_crtcs))

		return 0;

		return 0;



	return vblank->count;

	return vblank->count;

}

}

EXPORT_SYMBOL(drm_vblank_count);

EXPORT_SYMBOL(drm_vblank_count);
@@ -1110,10 +1111,10 @@ void drm_vblank_put(struct drm_device *dev, int crtc) 
{

{

	struct drm_vblank_crtc *vblank = &dev->vblank[crtc];

	struct drm_vblank_crtc *vblank = &dev->vblank[crtc];





	if (WARN_ON(atomic_read(&vblank->refcount) == 0))

	if (WARN_ON(crtc >= dev->num_crtcs))

		return;

		return;





	if (WARN_ON(crtc >= dev->num_crtcs))

	if (WARN_ON(atomic_read(&vblank->refcount) == 0))

		return;

		return;





	/* Last user schedules interrupt disable */

	/* Last user schedules interrupt disable */
@@ -1158,6 +1159,9 @@ void drm_wait_one_vblank(struct drm_device *dev, int crtc) 
	int ret;

	int ret;

	u32 last;

	u32 last;





	if (WARN_ON(crtc >= dev->num_crtcs))

		return;



	ret = drm_vblank_get(dev, crtc);

	ret = drm_vblank_get(dev, crtc);

	if (WARN(ret, "vblank not available on crtc %i, ret=%i\n", crtc, ret))

	if (WARN(ret, "vblank not available on crtc %i, ret=%i\n", crtc, ret))

		return;

		return;
@@ -1428,6 +1432,9 @@ void drm_vblank_post_modeset(struct drm_device *dev, int crtc) 
	if (!dev->num_crtcs)

	if (!dev->num_crtcs)

		return;

		return;





	if (WARN_ON(crtc >= dev->num_crtcs))

		return;



	if (vblank->inmodeset) {

	if (vblank->inmodeset) {

		spin_lock_irqsave(&dev->vbl_lock, irqflags);

		spin_lock_irqsave(&dev->vbl_lock, irqflags);

		dev->vblank_disable_allowed = true;

		dev->vblank_disable_allowed = true;