2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-08 05:34:29 +08:00
linux-next/drivers/gpu/drm/mxsfb
Marek Vasut 7ad7a5acfb drm: mxsfb: Fix crash when provided invalid DT bindings
The mxsfb driver will crash if the mxsfb DT node has a subnode,
but the content of the subnode is not of-graph binding with an
endpoint linking to panel. The crash was triggered by providing
old-style panel bindings to the mxsfb driver instead of the new
of-graph ones.

The problem happens in mxsfb_create_output(), which is invoked
from mxsfb_load(). The mxsfb_create_output() iterates over all
mxsfb DT subnode endpoints and tries to bind a panel on each
endpoint. If there is any problem binding the panel, that is,
mxsfb->panel == NULL, this function will return an error code,
otherwise success 0 is returned.

If the subnodes do not specify of-graph binding with an endpoint,
the iteration over endpoints in mxsfb_create_output() will have
zero cycles and the function will immediatelly return 0, but the
mxsfb->panel will remain NULL. This is propagated back into the
mxsfb_load(), which does not detect any problem and expects that
the mxsfb->panel is valid, thus calls mxsfb_panel_attach(). But
since mxsfb->panel == NULL, mxsfb_panel_attach() is called with
first argument NULL and this crashes the kernel.

This patch fixes the problem by explicitly checking for valid
mxsfb->panel at the end of the iteration in mxsfb_create_output().

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Stefan Agner <stefan@agner.ch>
Cc: Breno Matheus Lima <brenomatheus@gmail.com>
Tested-by: Breno Lima <breno.lima@nxp.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
2017-03-10 11:10:59 +10:00
..
Kconfig drm: mxsfb: Select DRM_PANEL 2016-12-08 10:25:37 +10:00
Makefile
mxsfb_crtc.c drm: mxsfb: fix pixel clock polarity 2017-03-10 11:10:49 +10:00
mxsfb_drv.c drm: Rely on mode_config data for fb_helper initialization 2017-02-02 19:12:00 +01:00
mxsfb_drv.h
mxsfb_out.c drm: mxsfb: Fix crash when provided invalid DT bindings 2017-03-10 11:10:59 +10:00
mxsfb_regs.h drm: mxsfb: use bus_format to determine LCD bus width 2017-03-10 11:10:42 +10:00