| Message ID | 4c250d21880ca0b97e41da7b6a101bdf07e9d015.1718305355.git.geert+renesas@glider.be (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | a63ee07883dea5265ff00e606034e6c72b247cbc |
| Delegated to: | Kieran Bingham |
| Headers | show |
| Series | drm/panic: Fixes and graphical logo | expand |
On 13/06/2024 21:17, Geert Uytterhoeven wrote: > No implementations of drm_plane_helper_funcs.get_scanout_buffer() fill > in the optional drm_scanout_buffer.set_pixel() member. Hence the member > may contain non-zero garbage, causing a crash when deferencing it during > drm panic. > > Fix this by pre-initializing the drm_scanout_buffer object before > calling drm_plane_helper_funcs.get_scanout_buffer(). Good catch, I don't know how I didn't hit this bug before. Thanks for the fix. Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> > > Fixes: 24d07f114e4ec760 ("drm/panic: Add a set_pixel() callback to drm_scanout_buffer") > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> > --- > v2: > - New. > --- > drivers/gpu/drm/drm_panic.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c > index 293d4dcbc80da7ba..fc04ed4e0b399f55 100644 > --- a/drivers/gpu/drm/drm_panic.c > +++ b/drivers/gpu/drm/drm_panic.c > @@ -582,7 +582,7 @@ static void draw_panic_dispatch(struct drm_scanout_buffer *sb) > > static void draw_panic_plane(struct drm_plane *plane) > { > - struct drm_scanout_buffer sb; > + struct drm_scanout_buffer sb = { }; > int ret; > unsigned long flags; >
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c index 293d4dcbc80da7ba..fc04ed4e0b399f55 100644 --- a/drivers/gpu/drm/drm_panic.c +++ b/drivers/gpu/drm/drm_panic.c @@ -582,7 +582,7 @@ static void draw_panic_dispatch(struct drm_scanout_buffer *sb) static void draw_panic_plane(struct drm_plane *plane) { - struct drm_scanout_buffer sb; + struct drm_scanout_buffer sb = { }; int ret; unsigned long flags;
No implementations of drm_plane_helper_funcs.get_scanout_buffer() fill in the optional drm_scanout_buffer.set_pixel() member. Hence the member may contain non-zero garbage, causing a crash when deferencing it during drm panic. Fix this by pre-initializing the drm_scanout_buffer object before calling drm_plane_helper_funcs.get_scanout_buffer(). Fixes: 24d07f114e4ec760 ("drm/panic: Add a set_pixel() callback to drm_scanout_buffer") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> --- v2: - New. --- drivers/gpu/drm/drm_panic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)