diff options
| author | Dmitry Osipenko <digetx@gmail.com> | 2016-08-21 11:57:58 +0300 |
|---|---|---|
| committer | Thierry Reding <treding@nvidia.com> | 2016-08-24 16:15:09 +0200 |
| commit | 08ee01789eebf433c27e8b3eecc3ddbb5f7c4d51 (patch) | |
| tree | 9a7d2b848fd71043a3c3bc69b4885d82ec78716e /drivers/gpu/drm/tegra | |
| parent | 87904c3e82319cf2bad8d656d79c5030dab9490e (diff) | |
| download | linux-08ee01789eebf433c27e8b3eecc3ddbb5f7c4d51.tar.bz2 | |
drm/tegra: Fix window[0] base address corruption
Window uses shared stride for UV planes and tegra_dc_window struct
defines array of 2 strides per window. That's not taken in account
during setting up of the window addresses and strides, resulting in
out-of-bounds write of the 3-rd (non-existent) V plane stride that
overwrites Y plane base address.
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
[treding@nvidia.com: explain why the V-plane stride is ignored]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Diffstat (limited to 'drivers/gpu/drm/tegra')
| -rw-r--r-- | drivers/gpu/drm/tegra/dc.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c index 8495bd01b544..981d24ae8328 100644 --- a/drivers/gpu/drm/tegra/dc.c +++ b/drivers/gpu/drm/tegra/dc.c @@ -591,7 +591,14 @@ static void tegra_plane_atomic_update(struct drm_plane *plane, struct tegra_bo *bo = tegra_fb_get_plane(fb, i); window.base[i] = bo->paddr + fb->offsets[i]; - window.stride[i] = fb->pitches[i]; + + /* + * Tegra uses a shared stride for UV planes. Framebuffers are + * already checked for this in the tegra_plane_atomic_check() + * function, so it's safe to ignore the V-plane pitch here. + */ + if (i < 2) + window.stride[i] = fb->pitches[i]; } tegra_dc_setup_window(dc, p->index, &window); |