From a63ee07883dea5265ff00e606034e6c72b247cbc Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Thu, 13 Jun 2024 21:17:59 +0200 Subject: [PATCH] drm/panic: Fix uninitialized drm_scanout_buffer.set_pixel() crash No implementations of drm_plane_helper_funcs.get_scanout_buffer() fill in the optional drm_scanout_buffer.set_pixel() member. Hence the member may contain non-zero garbage, causing a crash when deferencing it during drm panic. Fix this by pre-initializing the drm_scanout_buffer object before calling drm_plane_helper_funcs.get_scanout_buffer(). Fixes: 24d07f114e4ec760 ("drm/panic: Add a set_pixel() callback to drm_scanout_buffer") Signed-off-by: Geert Uytterhoeven Reviewed-by: Jocelyn Falempe Signed-off-by: Jocelyn Falempe Link: https://patchwork.freedesktop.org/patch/msgid/4c250d21880ca0b97e41da7b6a101bdf07e9d015.1718305355.git.geert+renesas@glider.be --- drivers/gpu/drm/drm_panic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c index 293d4dcbc80d..fc04ed4e0b39 100644 --- a/drivers/gpu/drm/drm_panic.c +++ b/drivers/gpu/drm/drm_panic.c @@ -582,7 +582,7 @@ static void draw_panic_dispatch(struct drm_scanout_buffer *sb) static void draw_panic_plane(struct drm_plane *plane) { - struct drm_scanout_buffer sb; + struct drm_scanout_buffer sb = { }; int ret; unsigned long flags;