From: Wolfram Stering <wolfram.stering@hale.at>
Date: Fri, 23 Sep 2011 12:09:35 +0000 (+0200)
Subject: mx3fb: fix NULL pointer dereference in screen blanking.
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=8b53b7fb57e1ce3441b1a32f8374874b53c4bc31;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

mx3fb: fix NULL pointer dereference in screen blanking.

When blanking an already blanked framebuffer, a kernel NULL pointer
dereference occurred, because mx3fb driver handles all kinds of screen
blanking (normal, vsync suspend, powerdown) in the same way.
Certain programs (Xorg X11 server) first do a normal blank, followed by
a powerdown blank, which triggered the bug.

Add an additional safeguard and make sdc_disable_channel() safe against
multiple calls independent of other logic.

Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
---

diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index bd768588cf10..e3406ab31305 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -382,6 +382,9 @@ static void sdc_disable_channel(struct mx3fb_info *mx3_fbi)
 	uint32_t enabled;
 	unsigned long flags;
 
+	if (mx3_fbi->txd == NULL)
+		return;
+
 	spin_lock_irqsave(&mx3fb->lock, flags);
 
 	enabled = sdc_fb_uninit(mx3_fbi);
@@ -986,9 +989,19 @@ static void __blank(int blank, struct fb_info *fbi)
 {
 	struct mx3fb_info *mx3_fbi = fbi->par;
 	struct mx3fb_data *mx3fb = mx3_fbi->mx3fb;
+	int was_blank = mx3_fbi->blank;
 
 	mx3_fbi->blank = blank;
 
+	/* Attention!
+	 * Do not call sdc_disable_channel() for a channel that is disabled
+	 * already! This will result in a kernel NULL pointer dereference
+	 * (mx3_fbi->txd is NULL). Hide the fact, that all blank modes are
+	 * handled equally by this driver.
+	 */
+	if (blank > FB_BLANK_UNBLANK && was_blank > FB_BLANK_UNBLANK)
+		return;
+
 	switch (blank) {
 	case FB_BLANK_POWERDOWN:
 	case FB_BLANK_VSYNC_SUSPEND: