mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config()
During boot time, MST devices usually send a ton of hotplug events irregardless of whether or not any physical hotplugs actually occurred. Hotplugs mean connectors being created/destroyed, and the number of DRM connectors changing under us. This isn't a problem if we use fb_helper->connector_count since we only set it once in the code, however if we use num_connector from struct drm_mode_config we risk it's value changing under us. On top of that, there's even a chance that dev->mode_config.num_connector != fb_helper->connector_count. If the number of connectors happens to increase under us, we'll end up using the wrong array size for memcpy and start writing beyond the actual length of the array, occasionally resulting in kernel panics. Note: This is just polish for 4.7, Dave Airlie's drm_connector refcounting fixed these bugs for real. But it's good enough duct-tape for stable kernel backporting, since backporting the refcounting changes is way too invasive. Cc: stable@vger.kernel.org Signed-off-by: Lyude <cpaul@redhat.com> [danvet: Clarify why we need this.] Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/1463065021-18280-2-git-send-email-cpaul@redhat.com
This commit is contained in:
parent
2d6b1d403e
commit
14a3842a1d
1 changed files with 3 additions and 3 deletions
|
@ -368,12 +368,12 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
|
|||
uint64_t conn_configured = 0, mask;
|
||||
int pass = 0;
|
||||
|
||||
save_enabled = kcalloc(dev->mode_config.num_connector, sizeof(bool),
|
||||
save_enabled = kcalloc(fb_helper->connector_count, sizeof(bool),
|
||||
GFP_KERNEL);
|
||||
if (!save_enabled)
|
||||
return false;
|
||||
|
||||
memcpy(save_enabled, enabled, dev->mode_config.num_connector);
|
||||
memcpy(save_enabled, enabled, fb_helper->connector_count);
|
||||
mask = (1 << fb_helper->connector_count) - 1;
|
||||
retry:
|
||||
for (i = 0; i < fb_helper->connector_count; i++) {
|
||||
|
@ -520,7 +520,7 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
|
|||
if (fallback) {
|
||||
bail:
|
||||
DRM_DEBUG_KMS("Not using firmware configuration\n");
|
||||
memcpy(enabled, save_enabled, dev->mode_config.num_connector);
|
||||
memcpy(enabled, save_enabled, fb_helper->connector_count);
|
||||
kfree(save_enabled);
|
||||
return false;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue