[PATCH] drm/exynos: fimd: fix buffer size calculation

[Daniel Stone]

Hi Marek,

On Mon, 13 Apr, 2015 at 8:28 AM, Marek Szyprowski 
<m.szyprowski at samsung.com> wrote:
> Commit adacb228d72b9529f8de0769cc33414c3012054d ("drm: Exynos: Respect
> framebuffer pitch for FIMD/Mixer") changed the way of buffer size
> calcularion: it replaced fb_width by fb_pitch entry. fb_pitch however
> already contains '(win_data->bpp >> 3)' factor, so it should be 
> removed
> from final buffer size calculation formula. This patch fixes this 
> issue,
> solving possible IOMMU page fault caused by FIMD module accessing 
> memory
> outside of the given display buffer.

Yes, you're right; sorry about this. It slipped in during a rebase and 
I definitely should've caught it. This has already been fixed for -next 
in the commit Inki pointed out, but in the meantime it should 
definitely be applied to stable as a more minimal fix.

Thanks for catching this and providing the fix.

Reviewed-by: Daniel Stone <daniels at collabora.com>

Cheers,
Daniel

> Signed-off by: Marek Szyprowski <m.szyprowski at samsung.com>
> CC: stable at vger.kernel.org  # v4.0+
> ---
>  drivers/gpu/drm/exynos/exynos_drm_fimd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c 
> b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
> index 0e93ed792224..f29a13e0524c 100644
> --- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
> +++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
> @@ -689,7 +689,7 @@ static void fimd_win_commit(struct 
> exynos_drm_crtc *crtc, unsigned int win)
>  	writel(val, ctx->regs + VIDWx_BUF_START(win, 0));
> 
>  	/* buffer end address */
> -	size = plane->pitch * plane->crtc_height * (plane->bpp >> 3);
> +	size = plane->pitch * plane->crtc_height;
>  	val = (unsigned long)(dma_addr + size);
>  	writel(val, ctx->regs + VIDWx_BUF_END(win, 0));
> 
> --
> 1.9.2
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20150413/fd27e0af/attachment-0001.html>