Commit 3cb52df5 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] fbdev: Fix NULL-ptr dereference in pm2fb_probe

From: Jim Hague <jim.hague@acm.org>

It fixes the NULL pointer dereference and also a problem in pm2fb_blank().
parent d04c36b4
...@@ -62,6 +62,16 @@ ...@@ -62,6 +62,16 @@
#define DPRINTK(a,b...) #define DPRINTK(a,b...)
#endif #endif
/*
* The 2.4 driver calls reset_card() at init time, where it also sets the
* initial mode. I don't think the driver should touch the chip until
* the console sets a video mode. So I was calling this at the start
* of setting a mode. However, certainly on 1280x1024 depth 16 on my
* PCI Graphics Blaster Exxtreme this causes the display to smear
* slightly. I don't know why. Guesses to jim.hague@acm.org.
*/
#undef RESET_CARD_ON_MODE_SET
/* /*
* Driver data * Driver data
*/ */
...@@ -340,16 +350,7 @@ static void clear_palette(struct pm2fb_par* p) { ...@@ -340,16 +350,7 @@ static void clear_palette(struct pm2fb_par* p) {
} }
} }
#if 0 #ifdef RESET_CARD_ON_MODE_SET
/*
* FIXME:
* The 2.4 driver calls this at init time, where it also sets the
* initial mode. I don't think the driver should touch the chip
* until the console sets a video mode. So I was calling this
* at the start of setting a mode. However, certainly on 1280x1024
* depth 16 this causes the display to smear slightly.
* I don't know why. Guesses to jim.hague@acm.org.
*/
static void reset_card(struct pm2fb_par* p) static void reset_card(struct pm2fb_par* p)
{ {
if (p->type == PM2_TYPE_PERMEDIA2V) if (p->type == PM2_TYPE_PERMEDIA2V)
...@@ -501,6 +502,8 @@ static void set_video(struct pm2fb_par* p, u32 video) { ...@@ -501,6 +502,8 @@ static void set_video(struct pm2fb_par* p, u32 video) {
u32 vsync; u32 vsync;
vsync = video; vsync = video;
DPRINTK("video = 0x%x\n", video);
/* /*
* The hardware cursor needs +vsync to recognise vert retrace. * The hardware cursor needs +vsync to recognise vert retrace.
...@@ -660,6 +663,9 @@ static int pm2fb_set_par(struct fb_info *info) ...@@ -660,6 +663,9 @@ static int pm2fb_set_par(struct fb_info *info)
u32 xres; u32 xres;
int data64; int data64;
#ifdef RESET_CARD_ON_MODE_SET
reset_card(par);
#endif
reset_config(par); reset_config(par);
clear_palette(par); clear_palette(par);
...@@ -721,8 +727,7 @@ static int pm2fb_set_par(struct fb_info *info) ...@@ -721,8 +727,7 @@ static int pm2fb_set_par(struct fb_info *info)
info->fix.visual = info->fix.visual =
(depth == 8) ? FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_TRUECOLOR; (depth == 8) ? FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_TRUECOLOR;
info->fix.line_length = info->fix.line_length = info->var.xres * depth / 8;
info->var.xres * ((info->var.bits_per_pixel + 7) >> 3);
info->cmap.len = 256; info->cmap.len = 256;
/* /*
...@@ -803,6 +808,8 @@ static int pm2fb_set_par(struct fb_info *info) ...@@ -803,6 +808,8 @@ static int pm2fb_set_par(struct fb_info *info)
break; break;
} }
set_pixclock(par, pixclock); set_pixclock(par, pixclock);
DPRINTK("Setting graphics mode at %dx%d depth %d\n",
info->var.xres, info->var.yres, info->var.bits_per_pixel);
return 0; return 0;
} }
...@@ -843,7 +850,8 @@ static int pm2fb_setcolreg(unsigned regno, unsigned red, unsigned green, ...@@ -843,7 +850,8 @@ static int pm2fb_setcolreg(unsigned regno, unsigned red, unsigned green,
* var->{color}.offset contains start of bitfield * var->{color}.offset contains start of bitfield
* var->{color}.length contains length of bitfield * var->{color}.length contains length of bitfield
* {hardwarespecific} contains width of DAC * {hardwarespecific} contains width of DAC
* cmap[X] is programmed to (X << red.offset) | (X << green.offset) | (X << blue.offset) * cmap[X] is programmed to
* (X << red.offset) | (X << green.offset) | (X << blue.offset)
* RAMDAC[X] is programmed to (red, green, blue) * RAMDAC[X] is programmed to (red, green, blue)
* *
* Pseudocolor: * Pseudocolor:
...@@ -856,8 +864,9 @@ static int pm2fb_setcolreg(unsigned regno, unsigned red, unsigned green, ...@@ -856,8 +864,9 @@ static int pm2fb_setcolreg(unsigned regno, unsigned red, unsigned green,
* does not use RAMDAC (usually has 3 of them). * does not use RAMDAC (usually has 3 of them).
* var->{color}.offset contains start of bitfield * var->{color}.offset contains start of bitfield
* var->{color}.length contains length of bitfield * var->{color}.length contains length of bitfield
* cmap is programmed to (red << red.offset) | (green << green.offset) | * cmap is programmed to
* (blue << blue.offset) | (transp << transp.offset) * (red << red.offset) | (green << green.offset) |
* (blue << blue.offset) | (transp << transp.offset)
* RAMDAC does not exist * RAMDAC does not exist
*/ */
#define CNVT_TOHW(val,width) ((((val)<<(width))+0x7FFF-(val))>>16) #define CNVT_TOHW(val,width) ((((val)<<(width))+0x7FFF-(val))>>16)
...@@ -962,6 +971,11 @@ static int pm2fb_blank(int blank_mode, struct fb_info *info) ...@@ -962,6 +971,11 @@ static int pm2fb_blank(int blank_mode, struct fb_info *info)
struct pm2fb_par *par = (struct pm2fb_par *) info->par; struct pm2fb_par *par = (struct pm2fb_par *) info->par;
u32 video = par->video; u32 video = par->video;
DPRINTK("blank_mode %d\n", blank_mode);
/* Turn everything on, then disable as requested. */
video |= (PM2F_VIDEO_ENABLE | PM2F_HSYNC_MASK | PM2F_VSYNC_MASK);
switch (blank_mode) { switch (blank_mode) {
case 0: /* Screen: On; HSync: On, VSync: On */ case 0: /* Screen: On; HSync: On, VSync: On */
break; break;
...@@ -1030,15 +1044,12 @@ static int __devinit pm2fb_probe(struct pci_dev *pdev, ...@@ -1030,15 +1044,12 @@ static int __devinit pm2fb_probe(struct pci_dev *pdev,
return err; return err;
} }
size = sizeof(struct fb_info) + sizeof(struct pm2fb_par) + 256 * sizeof(u32); size = sizeof(struct pm2fb_par) + 256 * sizeof(u32);
info = framebuffer_alloc(size, &pdev->dev); info = framebuffer_alloc(size, &pdev->dev);
if ( !info ) if ( !info )
return -ENOMEM; return -ENOMEM;
memset(info, 0, size); default_par = (struct pm2fb_par *) info->par;
default_par = info->par;
switch (pdev->device) { switch (pdev->device) {
case PCI_DEVICE_ID_TI_TVP4020: case PCI_DEVICE_ID_TI_TVP4020:
strcpy(pm2fb_fix.id, "TVP4020"); strcpy(pm2fb_fix.id, "TVP4020");
...@@ -1112,7 +1123,6 @@ static int __devinit pm2fb_probe(struct pci_dev *pdev, ...@@ -1112,7 +1123,6 @@ static int __devinit pm2fb_probe(struct pci_dev *pdev,
info->fbops = &pm2fb_ops; info->fbops = &pm2fb_ops;
info->fix = pm2fb_fix; info->fix = pm2fb_fix;
info->par = default_par;
info->pseudo_palette = (void *)(default_par + 1); info->pseudo_palette = (void *)(default_par + 1);
info->flags = FBINFO_FLAG_DEFAULT; info->flags = FBINFO_FLAG_DEFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment