diff options
| author | Geert Uytterhoeven <geert+renesas@glider.be> | 2024-06-13 21:17:59 +0200 |
|---|---|---|
| committer | Jocelyn Falempe <jfalempe@redhat.com> | 2024-06-24 13:18:00 +0200 |
| commit | a63ee07883dea5265ff00e606034e6c72b247cbc (patch) | |
| tree | 6ce2f5a575c4e903c82c4c2b394cf02a962568b5 | |
| parent | 07430fa5248964d5338382b4b2e9ebea3904238e (diff) | |
| download | linux-stable-a63ee07883dea5265ff00e606034e6c72b247cbc.tar.gz linux-stable-a63ee07883dea5265ff00e606034e6c72b247cbc.tar.bz2 linux-stable-a63ee07883dea5265ff00e606034e6c72b247cbc.zip | |
drm/panic: Fix uninitialized drm_scanout_buffer.set_pixel() crash
No implementations of drm_plane_helper_funcs.get_scanout_buffer() fill
in the optional drm_scanout_buffer.set_pixel() member. Hence the member
may contain non-zero garbage, causing a crash when deferencing it during
drm panic.
Fix this by pre-initializing the drm_scanout_buffer object before
calling drm_plane_helper_funcs.get_scanout_buffer().
Fixes: 24d07f114e4ec760 ("drm/panic: Add a set_pixel() callback to drm_scanout_buffer")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/4c250d21880ca0b97e41da7b6a101bdf07e9d015.1718305355.git.geert+renesas@glider.be
| -rw-r--r-- | drivers/gpu/drm/drm_panic.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c index 293d4dcbc80d..fc04ed4e0b39 100644 --- a/drivers/gpu/drm/drm_panic.c +++ b/drivers/gpu/drm/drm_panic.c @@ -582,7 +582,7 @@ static void draw_panic_dispatch(struct drm_scanout_buffer *sb) static void draw_panic_plane(struct drm_plane *plane) { - struct drm_scanout_buffer sb; + struct drm_scanout_buffer sb = { }; int ret; unsigned long flags; |