From patchwork Sun Feb 20 15:02:25 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vasily Khoruzhick X-Patchwork-Id: 575811 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p1KF3LJM022214 for ; Sun, 20 Feb 2011 15:03:22 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753902Ab1BTPDV (ORCPT ); Sun, 20 Feb 2011 10:03:21 -0500 Received: from mail-bw0-f46.google.com ([209.85.214.46]:62382 "EHLO mail-bw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752275Ab1BTPDV (ORCPT ); Sun, 20 Feb 2011 10:03:21 -0500 Received: by bwz15 with SMTP id 15so433464bwz.19 for ; Sun, 20 Feb 2011 07:03:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer :in-reply-to:references; bh=7q3IeR35ZAllExTMDzgPu7o8gOUa2GKIvxpDWVitv94=; b=kdSea6cviA4CyteeoXTY+bZauMvh3EdqC0CzxZ+H/MYng3xVp4gmJzAB3ZsedTNJI/ CuF2luCIhYz5hbAJroU60HU8IXsHPQ8awKz2yqSBxy0Fo+/If5ePtbQdW3e1PXS0RQSH FORiLgXQUPICgZQvhoZI7q+5KTy4vk/m2V4bc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; b=ZfcwCMCOz6lnZfPtbn4PpJ+JE3DrFXW35S/45+sPM2wCcHB38eJ6aI44woEOpwK08I 13VvESRzS1NPWysbUUiEMo4dbCeDIPnLHHa2CHcSrmKKNVGkk2wAjOWf7CPgp6rH1Yi4 hKK9t9zwLjoWOBgnZ6otfmZ9M9KGYNpdZnUCU= Received: by 10.204.122.198 with SMTP id m6mr367588bkr.186.1298214198974; Sun, 20 Feb 2011 07:03:18 -0800 (PST) Received: from localhost.localdomain ([80.249.93.202]) by mx.google.com with ESMTPS id b6sm3025835bkb.10.2011.02.20.07.03.16 (version=TLSv1/SSLv3 cipher=OTHER); Sun, 20 Feb 2011 07:03:17 -0800 (PST) From: Vasily Khoruzhick To: Russell King - ARM Linux , Marek Vasut , linux-fbdev@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Eric Miao , Sascha Hauer Cc: Vasily Khoruzhick Subject: [PATCH v2 1/3] ARM: PXA: PXAFB: Fix double-free issue Date: Sun, 20 Feb 2011 17:02:25 +0200 Message-Id: <1298214147-11578-1-git-send-email-anarsoul@gmail.com> X-Mailer: git-send-email 1.7.4 In-Reply-To: <20110217110321.GF24627@n2100.arm.linux.org.uk> References: <20110217110321.GF24627@n2100.arm.linux.org.uk> Sender: linux-fbdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fbdev@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Sun, 20 Feb 2011 15:03:56 +0000 (UTC) diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c index 825b665..41a499f 100644 --- a/drivers/video/pxafb.c +++ b/drivers/video/pxafb.c @@ -629,6 +629,9 @@ static void overlay1fb_disable(struct pxafb_layer *ofb) { uint32_t lccr5 = lcd_readl(ofb->fbi, LCCR5); + if (!(lcd_readl(ofb->fbi, OVL1C1) & OVLxC1_OEN)) + return; + lcd_writel(ofb->fbi, OVL1C1, ofb->control[0] & ~OVLxC1_OEN); lcd_writel(ofb->fbi, LCSR1, LCSR1_BS(1)); @@ -687,6 +690,9 @@ static void overlay2fb_disable(struct pxafb_layer *ofb) { uint32_t lccr5 = lcd_readl(ofb->fbi, LCCR5); + if (!(lcd_readl(ofb->fbi, OVL2C1) & OVLxC1_OEN)) + return; + lcd_writel(ofb->fbi, OVL2C1, ofb->control[0] & ~OVLxC1_OEN); lcd_writel(ofb->fbi, LCSR1, LCSR1_BS(2)); @@ -720,12 +726,10 @@ static int overlayfb_open(struct fb_info *info, int user) if (user == 0) return -ENODEV; - /* allow only one user at a time */ - if (atomic_inc_and_test(&ofb->usage)) - return -EBUSY; + if (ofb->usage++ == 0) + /* unblank the base framebuffer */ + fb_blank(&ofb->fbi->fb, FB_BLANK_UNBLANK); - /* unblank the base framebuffer */ - fb_blank(&ofb->fbi->fb, FB_BLANK_UNBLANK); return 0; } @@ -733,12 +737,24 @@ static int overlayfb_release(struct fb_info *info, int user) { struct pxafb_layer *ofb = (struct pxafb_layer*) info; - atomic_dec(&ofb->usage); - ofb->ops->disable(ofb); - - free_pages_exact(ofb->video_mem, ofb->video_mem_size); - ofb->video_mem = NULL; - ofb->video_mem_size = 0; + if (--ofb->usage == 0) { + ofb->ops->disable(ofb); + ofb->fb.var.height = -1; + ofb->fb.var.width = -1; + ofb->fb.var.xres = ofb->fb.var.xres_virtual = 0; + ofb->fb.var.yres = ofb->fb.var.yres_virtual = 0; + + mutex_lock(&ofb->fb.mm_lock); + ofb->fb.fix.smem_start = 0; + ofb->fb.fix.smem_len = 0; + mutex_unlock(&ofb->fb.mm_lock); + + if (ofb->video_mem) { + free_pages_exact(ofb->video_mem, ofb->video_mem_size); + ofb->video_mem = NULL; + ofb->video_mem_size = 0; + } + } return 0; } @@ -817,7 +833,8 @@ static int overlayfb_map_video_memory(struct pxafb_layer *ofb) if (ofb->video_mem_size >= size) return 0; - free_pages_exact(ofb->video_mem, ofb->video_mem_size); + /* don't re-allocate: userspace may have the buffer mapped */ + return -EINVAL; } ofb->video_mem = alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO); @@ -891,7 +908,7 @@ static void __devinit init_pxafb_overlay(struct pxafb_info *fbi, ofb->id = id; ofb->ops = &ofb_ops[id]; - atomic_set(&ofb->usage, 0); + ofb->usage = 0; ofb->fbi = fbi; init_completion(&ofb->branch_done); } @@ -1368,7 +1385,8 @@ static int pxafb_activate_var(struct fb_var_screeninfo *var, (lcd_readl(fbi, LCCR3) != fbi->reg_lccr3) || (lcd_readl(fbi, LCCR4) != fbi->reg_lccr4) || (lcd_readl(fbi, FDADR0) != fbi->fdadr[0]) || - (lcd_readl(fbi, FDADR1) != fbi->fdadr[1])) + ((fbi->lccr0 & LCCR0_SDS) && + (lcd_readl(fbi, FDADR1) != fbi->fdadr[1]))) pxafb_schedule_work(fbi, C_REENABLE); return 0; @@ -1420,7 +1438,8 @@ static void pxafb_enable_controller(struct pxafb_info *fbi) lcd_writel(fbi, LCCR0, fbi->reg_lccr0 & ~LCCR0_ENB); lcd_writel(fbi, FDADR0, fbi->fdadr[0]); - lcd_writel(fbi, FDADR1, fbi->fdadr[1]); + if (fbi->lccr0 & LCCR0_SDS) + lcd_writel(fbi, FDADR1, fbi->fdadr[1]); lcd_writel(fbi, LCCR0, fbi->reg_lccr0 | LCCR0_ENB); } diff --git a/drivers/video/pxafb.h b/drivers/video/pxafb.h index 2353521..84e3ae1 100644 --- a/drivers/video/pxafb.h +++ b/drivers/video/pxafb.h @@ -92,7 +92,7 @@ struct pxafb_layer_ops { struct pxafb_layer { struct fb_info fb; int id; - atomic_t usage; + uint32_t usage; uint32_t control[2]; struct pxafb_layer_ops *ops;