drm: rcar-du: Fix crash with groups that have less than 9 planes
Commit 917de180379d ("drm: rcar-du: Implement universal plane support")
made the number of planes per group dynamic, but didn't update all loops
over the planes array, resulting in out-of-bound accesses on DU
instances that have an odd number of CRTCs (such as the R8A7790). Fix
it.
Fixes: 917de180379d ("drm: rcar-du: Implement universal plane support")
Cc: stable@vger.kernel.org
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
index a400858..65d6ba6 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
@@ -214,7 +214,7 @@
unsigned int i;
u32 dspr = 0;
- for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) {
+ for (i = 0; i < rcrtc->group->num_planes; ++i) {
struct rcar_du_plane *plane = &rcrtc->group->planes[i];
unsigned int j;
@@ -445,7 +445,7 @@
rcar_du_crtc_start(rcrtc);
/* Commit the planes state. */
- for (i = 0; i < ARRAY_SIZE(rcrtc->group->planes); ++i) {
+ for (i = 0; i < rcrtc->group->num_planes; ++i) {
struct rcar_du_plane *plane = &rcrtc->group->planes[i];
if (plane->plane.state->crtc != &rcrtc->crtc)