From patchwork Thu Feb 17 07:43:07 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vasily Khoruzhick X-Patchwork-Id: 569481 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p1H7j0uC011198 for ; Thu, 17 Feb 2011 07:45:00 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753085Ab1BQHo1 (ORCPT ); Thu, 17 Feb 2011 02:44:27 -0500 Received: from mail-bw0-f46.google.com ([209.85.214.46]:61506 "EHLO mail-bw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752940Ab1BQHoZ (ORCPT ); Thu, 17 Feb 2011 02:44:25 -0500 Received: by bwz15 with SMTP id 15so1419964bwz.19 for ; Wed, 16 Feb 2011 23:44:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer :in-reply-to:references; bh=WhHV2TXjLkAughpNloTejVuNL1FQZf6qi/nwcr51NLk=; b=VnG49W0eBXodpxw4Cm2P0Cjr8/mDVBXQpZhVfzws/NKashFHlew6M+w+A5vxDVcVcF c8kE0inwA8+RTZtEqHV+C1iIjqvelIlOPXHd5Zv6QuMbp8FpIJk1VzBRUfe1Iv8LrUzS gamKIMXwpq+unVZwaianSoC210K32KSbz0NH4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; b=Twzwl7jOCwwWjJ9eG81AQZNFULz5OgWPgy3NFdOS0xmML/lvQ4//ORBfjlbE02xbgc LUGPtjNolbFSuA2a4XLOb+A/MEPi9yKgCSyuPchjM1WNCDo3xR/J506U/YyVlriXFF9c Zs/2DlCAUZY9YwwJC7F2RLuB3YvlB14EUeSAw= Received: by 10.204.113.9 with SMTP id y9mr1298045bkp.201.1297928664006; Wed, 16 Feb 2011 23:44:24 -0800 (PST) Received: from localhost.localdomain ([46.28.101.209]) by mx.google.com with ESMTPS id u23sm430189bkw.9.2011.02.16.23.44.18 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 16 Feb 2011 23:44:19 -0800 (PST) From: Vasily Khoruzhick To: Marek Vasut , linux-fbdev@vger.kernel.org, "Russell King - ARM Linux" , linux-arm-kernel@lists.infradead.org, Eric Miao Cc: Vasily Khoruzhick Subject: [PATCH 1/2] ARM: PXA: PXAFB: Fix double-free issue. Date: Thu, 17 Feb 2011 09:43:07 +0200 Message-Id: <1297928588-10545-1-git-send-email-anarsoul@gmail.com> X-Mailer: git-send-email 1.7.4 In-Reply-To: <201102151718.00800.anarsoul@gmail.com> References: <201102151718.00800.anarsoul@gmail.com> Sender: linux-fbdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fbdev@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Thu, 17 Feb 2011 07:45:05 +0000 (UTC) diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c index 825b665..c6aad56 100644 --- a/drivers/video/pxafb.c +++ b/drivers/video/pxafb.c @@ -629,6 +629,9 @@ static void overlay1fb_disable(struct pxafb_layer *ofb) { uint32_t lccr5 = lcd_readl(ofb->fbi, LCCR5); + if (!(lcd_readl(ofb->fbi, OVL1C1) & OVLxC1_OEN)) + return; + lcd_writel(ofb->fbi, OVL1C1, ofb->control[0] & ~OVLxC1_OEN); lcd_writel(ofb->fbi, LCSR1, LCSR1_BS(1)); @@ -636,7 +639,8 @@ static void overlay1fb_disable(struct pxafb_layer *ofb) lcd_writel(ofb->fbi, FBR1, ofb->fbi->fdadr[DMA_OV1] | 0x3); if (wait_for_completion_timeout(&ofb->branch_done, 1 * HZ) == 0) - pr_warning("%s: timeout disabling overlay1\n", __func__); + pr_warning("%s: timeout disabling overlay1\n", + __func__); lcd_writel(ofb->fbi, LCCR5, lccr5); } @@ -687,6 +691,9 @@ static void overlay2fb_disable(struct pxafb_layer *ofb) { uint32_t lccr5 = lcd_readl(ofb->fbi, LCCR5); + if (!(lcd_readl(ofb->fbi, OVL2C1) & OVLxC1_OEN)) + return; + lcd_writel(ofb->fbi, OVL2C1, ofb->control[0] & ~OVLxC1_OEN); lcd_writel(ofb->fbi, LCSR1, LCSR1_BS(2)); @@ -696,7 +703,8 @@ static void overlay2fb_disable(struct pxafb_layer *ofb) lcd_writel(ofb->fbi, FBR4, ofb->fbi->fdadr[DMA_OV2_Cr] | 0x3); if (wait_for_completion_timeout(&ofb->branch_done, 1 * HZ) == 0) - pr_warning("%s: timeout disabling overlay2\n", __func__); + pr_warning("%s: timeout disabling overlay2\n", + __func__); } static struct pxafb_layer_ops ofb_ops[] = { @@ -720,12 +728,10 @@ static int overlayfb_open(struct fb_info *info, int user) if (user == 0) return -ENODEV; - /* allow only one user at a time */ - if (atomic_inc_and_test(&ofb->usage)) - return -EBUSY; + if (ofb->usage++ == 0) + /* unblank the base framebuffer */ + fb_blank(&ofb->fbi->fb, FB_BLANK_UNBLANK); - /* unblank the base framebuffer */ - fb_blank(&ofb->fbi->fb, FB_BLANK_UNBLANK); return 0; } @@ -733,12 +739,24 @@ static int overlayfb_release(struct fb_info *info, int user) { struct pxafb_layer *ofb = (struct pxafb_layer*) info; - atomic_dec(&ofb->usage); - ofb->ops->disable(ofb); - - free_pages_exact(ofb->video_mem, ofb->video_mem_size); - ofb->video_mem = NULL; - ofb->video_mem_size = 0; + if (--ofb->usage == 0) { + ofb->ops->disable(ofb); + ofb->fb.var.height = -1; + ofb->fb.var.width = -1; + ofb->fb.var.xres = ofb->fb.var.xres_virtual = 0; + ofb->fb.var.yres = ofb->fb.var.yres_virtual = 0; + + mutex_lock(&ofb->fb.mm_lock); + ofb->fb.fix.smem_start = 0; + ofb->fb.fix.smem_len = 0; + mutex_unlock(&ofb->fb.mm_lock); + + if (ofb->video_mem) { + free_pages_exact(ofb->video_mem, ofb->video_mem_size); + ofb->video_mem = NULL; + ofb->video_mem_size = 0; + } + } return 0; } @@ -817,7 +835,8 @@ static int overlayfb_map_video_memory(struct pxafb_layer *ofb) if (ofb->video_mem_size >= size) return 0; - free_pages_exact(ofb->video_mem, ofb->video_mem_size); + /* don't re-allocate: userspace may have the buffer mapped */ + return -EINVAL; } ofb->video_mem = alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO); @@ -891,7 +910,7 @@ static void __devinit init_pxafb_overlay(struct pxafb_info *fbi, ofb->id = id; ofb->ops = &ofb_ops[id]; - atomic_set(&ofb->usage, 0); + ofb->usage = 0; ofb->fbi = fbi; init_completion(&ofb->branch_done); } @@ -1368,7 +1387,8 @@ static int pxafb_activate_var(struct fb_var_screeninfo *var, (lcd_readl(fbi, LCCR3) != fbi->reg_lccr3) || (lcd_readl(fbi, LCCR4) != fbi->reg_lccr4) || (lcd_readl(fbi, FDADR0) != fbi->fdadr[0]) || - (lcd_readl(fbi, FDADR1) != fbi->fdadr[1])) + ((fbi->lccr0 & LCCR0_SDS) && + (lcd_readl(fbi, FDADR1) != fbi->fdadr[1]))) pxafb_schedule_work(fbi, C_REENABLE); return 0; @@ -1420,7 +1440,8 @@ static void pxafb_enable_controller(struct pxafb_info *fbi) lcd_writel(fbi, LCCR0, fbi->reg_lccr0 & ~LCCR0_ENB); lcd_writel(fbi, FDADR0, fbi->fdadr[0]); - lcd_writel(fbi, FDADR1, fbi->fdadr[1]); + if (fbi->lccr0 & LCCR0_SDS) + lcd_writel(fbi, FDADR1, fbi->fdadr[1]); lcd_writel(fbi, LCCR0, fbi->reg_lccr0 | LCCR0_ENB); } diff --git a/drivers/video/pxafb.h b/drivers/video/pxafb.h index 2353521..84e3ae1 100644 --- a/drivers/video/pxafb.h +++ b/drivers/video/pxafb.h @@ -92,7 +92,7 @@ struct pxafb_layer_ops { struct pxafb_layer { struct fb_info fb; int id; - atomic_t usage; + uint32_t usage; uint32_t control[2]; struct pxafb_layer_ops *ops;