diff options
| author |   Bruno Prémont <bonbons@linux-vserver.org> | 2011-05-14 12:24:15 +0200 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@linux-foundation.org> | 2011-05-14 10:28:54 -0700 |
| commit | c590cece75728a85ea06801df3ebad2d7ad8612c (patch) | |
| tree | 3f3f7ade41317d86305a3839d9f2ad646945aa60 /drivers | |
| parent | fbmem: fix remove_conflicting_framebuffers races (diff) | |
| download | linux-dev-c590cece75728a85ea06801df3ebad2d7ad8612c.tar.xz linux-dev-c590cece75728a85ea06801df3ebad2d7ad8612c.zip | |
Further fbcon sanity checking
This moves the
if (num_registered_fb == FB_MAX)
return -ENXIO;
check _AFTER_ the call to do_remove_conflicting_framebuffers() as this
would (now in a safe way) allow a native driver to replace the
conflicting one even if all slots in registered_fb[] are taken.
This also prevents unregistering a framebuffer that is no longer
registered (vga16f will unregister at module unload time even if the
frame buffer had been unregistered earlier due to being found
conflicting).
Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/fbmem.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c index 46ee5e5a08c6..5aac00eb1830 100644 --- a/drivers/video/fbmem.c +++ b/drivers/video/fbmem.c @@ -1573,15 +1573,15 @@ static int do_register_framebuffer(struct fb_info *fb_info) struct fb_event event; struct fb_videomode mode; - if (num_registered_fb == FB_MAX) - return -ENXIO; - if (fb_check_foreignness(fb_info)) return -ENOSYS; do_remove_conflicting_framebuffers(fb_info->apertures, fb_info->fix.id, fb_is_primary_device(fb_info)); + if (num_registered_fb == FB_MAX) + return -ENXIO; + num_registered_fb++; for (i = 0 ; i < FB_MAX; i++) if (!registered_fb[i]) @@ -1639,7 +1639,7 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) int i, ret = 0; i = fb_info->node; - if (!registered_fb[i]) + if (i < 0 || i >= FB_MAX || registered_fb[i] != fb_info) return -EINVAL; if (!lock_fb_info(fb_info)) |