Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/bridge: tc358767: copy the mode data, instead of storing the pointer

In tc_bridge_mode_set callback, we store the pointer to the given
drm_display_mode, and use the mode later. Storing a pointer in such a
way looks very suspicious to me, and I have observed odd issues where
the timings were apparently (at least mostly) zero.

Do a copy of the drm_display_mode instead to ensure we don't refer to
freed/modified data.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190528082747.3631-21-tomi.valkeinen@ti.com

authored by

Tomi Valkeinen and committed by
Andrzej Hajda
46648a3c 0cdb42f3

+4 -4
+4 -4
drivers/gpu/drm/bridge/tc358767.c
··· 205 205 /* display edid */ 206 206 struct edid *edid; 207 207 /* current mode */ 208 - const struct drm_display_mode *mode; 208 + struct drm_display_mode mode; 209 209 210 210 u32 rev; 211 211 u8 assr; ··· 1032 1032 /* PXL PLL setup */ 1033 1033 if (tc_test_pattern) { 1034 1034 ret = tc_pxl_pll_en(tc, clk_get_rate(tc->refclk), 1035 - 1000 * tc->mode->clock); 1035 + 1000 * tc->mode.clock); 1036 1036 if (ret) 1037 1037 goto err; 1038 1038 } 1039 1039 1040 - ret = tc_set_video_mode(tc, tc->mode); 1040 + ret = tc_set_video_mode(tc, &tc->mode); 1041 1041 if (ret) 1042 1042 return ret; 1043 1043 ··· 1180 1180 { 1181 1181 struct tc_data *tc = bridge_to_tc(bridge); 1182 1182 1183 - tc->mode = mode; 1183 + tc->mode = *mode; 1184 1184 } 1185 1185 1186 1186 static int tc_connector_get_modes(struct drm_connector *connector)