diff options
| author | Hans de Goede <hdegoede@redhat.com> | 2018-09-18 19:44:36 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-09-20 12:32:05 +0200 |
| commit | 114094c83ed334524ee1a50bd8c08425f361148b (patch) | |
| tree | efa6b974501666df434fcdae928002f6b4776831 /drivers/staging/vboxvideo/vbox_mode.c | |
| parent | 0fdda2ce74e5fe2d9ff813895fcf0f716be66290 (diff) | |
staging: vboxvideo: Fix NULL ptr deref in vbox_set_up_input_mapping()
When vbox_set_up_input_mapping() gets called the first crtc might be
disable and not have a fb at all, triggering a NUL ptr deref at:
vbox->input_mapping_width = CRTC_FB(crtci)->width;
Instead of using the fb from the crtc with id 0, just use the fb from
the first crtc with a fb. This is in the single_framebuffer = true path,
so all crtc-s point to the same fb anyways.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/vboxvideo/vbox_mode.c')
| -rw-r--r-- | drivers/staging/vboxvideo/vbox_mode.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/staging/vboxvideo/vbox_mode.c b/drivers/staging/vboxvideo/vbox_mode.c index 1a2416a59fe0..910ea19931c9 100644 --- a/drivers/staging/vboxvideo/vbox_mode.c +++ b/drivers/staging/vboxvideo/vbox_mode.c @@ -189,17 +189,17 @@ static bool vbox_set_up_input_mapping(struct vbox_private *vbox) } } if (single_framebuffer) { + vbox->single_framebuffer = true; list_for_each_entry(crtci, &vbox->ddev.mode_config.crtc_list, head) { - if (to_vbox_crtc(crtci)->crtc_id != 0) + if (!CRTC_FB(crtci)) continue; - vbox->single_framebuffer = true; vbox->input_mapping_width = CRTC_FB(crtci)->width; vbox->input_mapping_height = CRTC_FB(crtci)->height; - return old_single_framebuffer != - vbox->single_framebuffer; + break; } + return old_single_framebuffer != vbox->single_framebuffer; } /* Otherwise calculate the total span of all screens. */ list_for_each_entry(connectori, &vbox->ddev.mode_config.connector_list, |