ExternalVendorCode/genode
1
0
Fork 0
mirror of https://github.com/genodelabs/genode.git synced 2025-02-27 11:59:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

intel_fb: fix framebuffer freeup

Browse Source 
drm_framebuffer_remove takes care of references to CRTC pointers before
freeing up framebuffer object. Directly calling the destroy function may cause
dangling CRTC pointers pointing inside the framebuffer object.

Fixes #2140
This commit is contained in:
Alexander Boettcher 2016-10-18 16:14:46 +02:00 committed by Christian Helmuth
parent 9d84541e6f
commit 61e1cf76c2
4 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
repos/dde_linux/patches/intel_fb_drm_remove.patch Normal file
View File

@ -0,0 +1,13 @@
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -13567,6 +13568,10 @@
intel_crtc = to_intel_crtc(crtc);
plane->fb = fb;
+
+ if (!crtc)
+ return;
+
crtc->x = src->x1 >> 16;
crtc->y = src->y1 >> 16;

2
repos/dde_linux/ports/dde_linux.hash
View File

@ -1 +1 @@
a94822e34f6074f3bb84c5300925c72502066eb0 01af4e74fb2b25133f181d1b73d673b9683c330b

1
repos/dde_linux/ports/dde_linux.port
View File

@ -193,5 +193,6 @@ PATCH_OPT(patches/usb_usbnet.patch) := $(USB_OPT)
# INTEL FB # INTEL FB
PATCH_OPT(patches/intel_fb_export_api.patch) := -p1 -d$(SRC_DIR_INTEL_FB) PATCH_OPT(patches/intel_fb_export_api.patch) := -p1 -d$(SRC_DIR_INTEL_FB)
PATCH_OPT(patches/intel_fb_drm_remove.patch) := -p1 -d$(SRC_DIR_INTEL_FB)
# vi: set ft=make : # vi: set ft=make :

3
repos/dde_linux/src/drivers/framebuffer/intel/lx_emul.cc
View File

@ -188,7 +188,8 @@ void Framebuffer::Driver::update_mode()
} }
if (old._lx.addr) Lx::iounmap(old._lx.addr); if (old._lx.addr) Lx::iounmap(old._lx.addr);
if (old._lx.lx_fb) old._lx.lx_fb->funcs->destroy(old._lx.lx_fb); /* drm_crtc.h in drm_framebuffer_funcs definition: use drm_fb_remove */
if (old._lx.lx_fb) drm_framebuffer_remove(old._lx.lx_fb);
} }