diff options
| author | Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> | 2015-05-25 16:32:45 +0300 |
|---|---|---|
| committer | Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> | 2015-06-16 14:25:43 +0300 |
| commit | d6aed57481c5b746f91792c8a977f537c09e52c5 (patch) | |
| tree | 8682803bf6b4d391c4df4a3df094cfdba5eeb5e8 /drivers/gpu/drm/rcar-du/rcar_du_crtc.c | |
| parent | 911316fe2f4113a096b9975f2467fc501864aef0 (diff) | |
| download | op-kernel-dev-d6aed57481c5b746f91792c8a977f537c09e52c5.zip op-kernel-dev-d6aed57481c5b746f91792c8a977f537c09e52c5.tar.gz | |
drm: rcar-du: Fix crash with groups that have less than 9 planes
Commit 917de180379d ("drm: rcar-du: Implement universal plane support")
made the number of planes per group dynamic, but didn't update all loops
over the planes array, resulting in out-of-bound accesses on DU
instances that have an odd number of CRTCs (such as the R8A7790). Fix
it.
Fixes: 917de180379d ("drm: rcar-du: Implement universal plane support")
Cc: stable@vger.kernel.org
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Diffstat (limited to 'drivers/gpu/drm/rcar-du/rcar_du_crtc.c')
| -rw-r--r-- | drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c index a400858..65d6ba6 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c @@ -214,7 +214,7 @@ static void rcar_du_crtc_update_planes(struct rcar_du_crtc *rcrtc) unsigned int i; u32 dspr = 0; - for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) { + for (i = 0; i < rcrtc->group->num_planes; ++i) { struct rcar_du_plane *plane = &rcrtc->group->planes[i]; unsigned int j; @@ -445,7 +445,7 @@ void rcar_du_crtc_resume(struct rcar_du_crtc *rcrtc) rcar_du_crtc_start(rcrtc); /* Commit the planes state. */ - for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) { + for (i = 0; i < rcrtc->group->num_planes; ++i) { struct rcar_du_plane *plane = &rcrtc->group->planes[i]; if (plane->plane.state->crtc != &rcrtc->crtc) |
