From 4cd54d986e8a1e28b70cfeb748c3ce734635bb4b Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Thu, 8 Oct 2015 18:17:48 +0530 Subject: [PATCH 1/3] drm/gma500: fix double freeing We are allocating backing using psbfb_alloc() and so backing->stolen is always true. So we were freeing backing two times. Moreover if we follow the execution path then we should be freeing backing after we have released the helper. So remove the one which frees backing before the helper is released. While at it the error labels are also renamed to give a meaningful name. [Patrik: Fixed conflict with removal of struct_mutex] Signed-off-by: Sudip Mukherjee Reviewed-by: Patrik Jakobsson Signed-off-by: Patrik Jakobsson --- drivers/gpu/drm/gma500/framebuffer.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c index 033d894d030e..ec2bc769742a 100644 --- a/drivers/gpu/drm/gma500/framebuffer.c +++ b/drivers/gpu/drm/gma500/framebuffer.c @@ -411,7 +411,7 @@ static int psbfb_create(struct psb_fbdev *fbdev, info = drm_fb_helper_alloc_fbi(&fbdev->psb_fb_helper); if (IS_ERR(info)) { ret = PTR_ERR(info); - goto out_err1; + goto err_free_range; } info->par = fbdev; @@ -419,7 +419,7 @@ static int psbfb_create(struct psb_fbdev *fbdev, ret = psb_framebuffer_init(dev, psbfb, &mode_cmd, backing); if (ret) - goto out_unref; + goto err_release; fb = &psbfb->base; psbfb->fbdev = info; @@ -464,14 +464,9 @@ static int psbfb_create(struct psb_fbdev *fbdev, psbfb->base.width, psbfb->base.height); return 0; -out_unref: - if (backing->stolen) - psb_gtt_free_range(dev, backing); - else - drm_gem_object_unreference_unlocked(&backing->gem); - +err_release: drm_fb_helper_release_fbi(&fbdev->psb_fb_helper); -out_err1: +err_free_range: psb_gtt_free_range(dev, backing); return ret; } From 7ccca1d5bf69fdd1d3c5fcf84faf1659a6e0ad11 Mon Sep 17 00:00:00 2001 From: Itai Handler Date: Tue, 3 Nov 2015 00:20:56 +0200 Subject: [PATCH 2/3] drm/gma500: Fix possible out of bounds read Fix possible out of bounds read, by adding missing comma. The code may read pass the end of the dsi_errors array when the most significant bit (bit #31) in the intr_stat register is set. This bug has been detected using CppCheck (static analysis tool). Cc: stable@vger.kernel.org Signed-off-by: Itai Handler Signed-off-by: Patrik Jakobsson --- drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c index 6b43ae3ffd73..1616af209bfc 100644 --- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c +++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c @@ -72,7 +72,7 @@ static const char *const dsi_errors[] = { "RX Prot Violation", "HS Generic Write FIFO Full", "LP Generic Write FIFO Full", - "Generic Read Data Avail" + "Generic Read Data Avail", "Special Packet Sent", "Tearing Effect", }; From 7d323264bec07cd71df47333c6cd8f6b36987821 Mon Sep 17 00:00:00 2001 From: Alan Date: Wed, 6 Apr 2016 14:41:09 +0100 Subject: [PATCH 3/3] drm/gma500/mdfld_dsi: remove bogus if check Both cases produce the same result. Kill the junk code. Signed-off-by: Alan Cox Signed-off-by: Patrik Jakobsson --- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c index 7cd87a0c2385..a05c020602bd 100644 --- a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c +++ b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c @@ -979,11 +979,7 @@ struct mdfld_dsi_encoder *mdfld_dsi_dpi_init(struct drm_device *dev, return NULL; } - if (dsi_connector->pipe) - dpi_output->panel_on = 0; - else - dpi_output->panel_on = 0; - + dpi_output->panel_on = 0; dpi_output->dev = dev; if (mdfld_get_panel_type(dev, pipe) != TC35876X) dpi_output->p_funcs = p_funcs;