On Wed, Aug 12, 2015 at 05:40:11PM +0200, Daniel Vetter wrote:
On Wed, Aug 12, 2015 at 05:00:30PM +0200, Thierry Reding wrote:
From: Thierry Reding treding@nvidia.com
When accessing the array of per-CRTC VBLANK structures we must always check that the index into the array is valid before dereferencing to avoid crashing.
Signed-off-by: Thierry Reding treding@nvidia.com
This misses vblank_reset (I guess that function is newer than your patches). Can you please do a follow-up? I merged this one meanwhile.
We only have drm_crtc_vblank_reset(), in which case there's no need to check the index because it's obtained directly from a struct drm_crtc * and hence will be valid.
Thierry
drivers/gpu/drm/drm_irq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c index 5c666c780fe9..a957b9618e85 100644 --- a/drivers/gpu/drm/drm_irq.c +++ b/drivers/gpu/drm/drm_irq.c @@ -1110,10 +1110,10 @@ void drm_vblank_put(struct drm_device *dev, int crtc) { struct drm_vblank_crtc *vblank = &dev->vblank[crtc];
- if (WARN_ON(atomic_read(&vblank->refcount) == 0))
- if (WARN_ON(crtc >= dev->num_crtcs)) return;
- if (WARN_ON(crtc >= dev->num_crtcs))
if (WARN_ON(atomic_read(&vblank->refcount) == 0)) return;
/* Last user schedules interrupt disable */
@@ -1158,6 +1158,9 @@ void drm_wait_one_vblank(struct drm_device *dev, int crtc) int ret; u32 last;
- if (WARN_ON(crtc >= dev->num_crtcs))
return;- ret = drm_vblank_get(dev, crtc); if (WARN(ret, "vblank not available on crtc %i, ret=%i\n", crtc, ret)) return;
@@ -1428,6 +1431,9 @@ void drm_vblank_post_modeset(struct drm_device *dev, int crtc) if (!dev->num_crtcs) return;
- if (WARN_ON(crtc >= dev->num_crtcs))
return;- if (vblank->inmodeset) { spin_lock_irqsave(&dev->vbl_lock, irqflags); dev->vblank_disable_allowed = true;
-- 2.4.5
-- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch