[VIDEO]: Fix OOPS in all SBUS framebuffer drivers.
All of these drivers use a silly:
struct all_info {
struct fb_info info;
struct foo_par par;
};
struct all_info *all = kzalloc(sizeof(*all), GFP_KERNEL);
all->info.par = &all->par;
etc. etc. code sequence, basically replicating the provided
framebuffer_alloc()/framebuffer_release(), and doing it badly.
Not only is this massive code duplication, it also caused a
bug in that we weren't setting the fb_info->device pointer
which results in an OOPS when fb_is_primary_device() runs.
Fix all of this by using framebuffer_{alloc,release}() and
passing in "&of_device->dev" as the device pointer.
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/video/tcx.c b/drivers/video/tcx.c
index 5a99669..e5a9ddb 100644
--- a/drivers/video/tcx.c
+++ b/drivers/video/tcx.c
@@ -345,88 +345,82 @@
info->fix.accel = FB_ACCEL_SUN_TCX;
}
-struct all_info {
- struct fb_info info;
- struct tcx_par par;
-};
-
-static void tcx_unmap_regs(struct of_device *op, struct all_info *all)
+static void tcx_unmap_regs(struct of_device *op, struct fb_info *info,
+ struct tcx_par *par)
{
- if (all->par.tec)
+ if (par->tec)
of_iounmap(&op->resource[7],
- all->par.tec, sizeof(struct tcx_tec));
- if (all->par.thc)
+ par->tec, sizeof(struct tcx_tec));
+ if (par->thc)
of_iounmap(&op->resource[9],
- all->par.thc, sizeof(struct tcx_thc));
- if (all->par.bt)
+ par->thc, sizeof(struct tcx_thc));
+ if (par->bt)
of_iounmap(&op->resource[8],
- all->par.bt, sizeof(struct bt_regs));
- if (all->par.cplane)
+ par->bt, sizeof(struct bt_regs));
+ if (par->cplane)
of_iounmap(&op->resource[4],
- all->par.cplane, all->par.fbsize * sizeof(u32));
- if (all->info.screen_base)
+ par->cplane, par->fbsize * sizeof(u32));
+ if (info->screen_base)
of_iounmap(&op->resource[0],
- all->info.screen_base, all->par.fbsize);
+ info->screen_base, par->fbsize);
}
static int __devinit tcx_init_one(struct of_device *op)
{
struct device_node *dp = op->node;
- struct all_info *all;
+ struct fb_info *info;
+ struct tcx_par *par;
int linebytes, i, err;
- all = kzalloc(sizeof(*all), GFP_KERNEL);
- if (!all)
- return -ENOMEM;
+ info = framebuffer_alloc(sizeof(struct tcx_par), &op->dev);
- spin_lock_init(&all->par.lock);
+ err = -ENOMEM;
+ if (!info)
+ goto out_err;
+ par = info->par;
- all->par.lowdepth =
+ spin_lock_init(&par->lock);
+
+ par->lowdepth =
(of_find_property(dp, "tcx-8-bit", NULL) != NULL);
- sbusfb_fill_var(&all->info.var, dp->node, 8);
- all->info.var.red.length = 8;
- all->info.var.green.length = 8;
- all->info.var.blue.length = 8;
+ sbusfb_fill_var(&info->var, dp->node, 8);
+ info->var.red.length = 8;
+ info->var.green.length = 8;
+ info->var.blue.length = 8;
linebytes = of_getintprop_default(dp, "linebytes",
- all->info.var.xres);
- all->par.fbsize = PAGE_ALIGN(linebytes * all->info.var.yres);
+ info->var.xres);
+ par->fbsize = PAGE_ALIGN(linebytes * info->var.yres);
- all->par.tec = of_ioremap(&op->resource[7], 0,
+ par->tec = of_ioremap(&op->resource[7], 0,
sizeof(struct tcx_tec), "tcx tec");
- all->par.thc = of_ioremap(&op->resource[9], 0,
+ par->thc = of_ioremap(&op->resource[9], 0,
sizeof(struct tcx_thc), "tcx thc");
- all->par.bt = of_ioremap(&op->resource[8], 0,
+ par->bt = of_ioremap(&op->resource[8], 0,
sizeof(struct bt_regs), "tcx dac");
- all->info.screen_base = of_ioremap(&op->resource[0], 0,
- all->par.fbsize, "tcx ram");
- if (!all->par.tec || !all->par.thc ||
- !all->par.bt || !all->info.screen_base) {
- tcx_unmap_regs(op, all);
- kfree(all);
- return -ENOMEM;
- }
+ info->screen_base = of_ioremap(&op->resource[0], 0,
+ par->fbsize, "tcx ram");
+ if (!par->tec || !par->thc ||
+ !par->bt || !info->screen_base)
+ goto out_unmap_regs;
- memcpy(&all->par.mmap_map, &__tcx_mmap_map, sizeof(all->par.mmap_map));
- if (!all->par.lowdepth) {
- all->par.cplane = of_ioremap(&op->resource[4], 0,
- all->par.fbsize * sizeof(u32),
+ memcpy(&par->mmap_map, &__tcx_mmap_map, sizeof(par->mmap_map));
+ if (!par->lowdepth) {
+ par->cplane = of_ioremap(&op->resource[4], 0,
+ par->fbsize * sizeof(u32),
"tcx cplane");
- if (!all->par.cplane) {
- tcx_unmap_regs(op, all);
- kfree(all);
- return -ENOMEM;
- }
+ if (!par->cplane)
+ goto out_unmap_regs;
} else {
- all->par.mmap_map[1].size = SBUS_MMAP_EMPTY;
- all->par.mmap_map[4].size = SBUS_MMAP_EMPTY;
- all->par.mmap_map[5].size = SBUS_MMAP_EMPTY;
- all->par.mmap_map[6].size = SBUS_MMAP_EMPTY;
+ par->mmap_map[1].size = SBUS_MMAP_EMPTY;
+ par->mmap_map[4].size = SBUS_MMAP_EMPTY;
+ par->mmap_map[5].size = SBUS_MMAP_EMPTY;
+ par->mmap_map[6].size = SBUS_MMAP_EMPTY;
}
- all->par.physbase = 0;
- all->par.which_io = op->resource[0].flags & IORESOURCE_BITS;
+ par->physbase = 0;
+ par->which_io = op->resource[0].flags & IORESOURCE_BITS;
for (i = 0; i < TCX_MMAP_ENTRIES; i++) {
int j;
@@ -444,53 +438,54 @@
j = i;
break;
};
- all->par.mmap_map[i].poff = op->resource[j].start;
+ par->mmap_map[i].poff = op->resource[j].start;
}
- all->info.flags = FBINFO_DEFAULT;
- all->info.fbops = &tcx_ops;
- all->info.par = &all->par;
+ info->flags = FBINFO_DEFAULT;
+ info->fbops = &tcx_ops;
/* Initialize brooktree DAC. */
- sbus_writel(0x04 << 24, &all->par.bt->addr); /* color planes */
- sbus_writel(0xff << 24, &all->par.bt->control);
- sbus_writel(0x05 << 24, &all->par.bt->addr);
- sbus_writel(0x00 << 24, &all->par.bt->control);
- sbus_writel(0x06 << 24, &all->par.bt->addr); /* overlay plane */
- sbus_writel(0x73 << 24, &all->par.bt->control);
- sbus_writel(0x07 << 24, &all->par.bt->addr);
- sbus_writel(0x00 << 24, &all->par.bt->control);
+ sbus_writel(0x04 << 24, &par->bt->addr); /* color planes */
+ sbus_writel(0xff << 24, &par->bt->control);
+ sbus_writel(0x05 << 24, &par->bt->addr);
+ sbus_writel(0x00 << 24, &par->bt->control);
+ sbus_writel(0x06 << 24, &par->bt->addr); /* overlay plane */
+ sbus_writel(0x73 << 24, &par->bt->control);
+ sbus_writel(0x07 << 24, &par->bt->addr);
+ sbus_writel(0x00 << 24, &par->bt->control);
- tcx_reset(&all->info);
+ tcx_reset(info);
- tcx_blank(FB_BLANK_UNBLANK, &all->info);
+ tcx_blank(FB_BLANK_UNBLANK, info);
- if (fb_alloc_cmap(&all->info.cmap, 256, 0)) {
- tcx_unmap_regs(op, all);
- kfree(all);
- return -ENOMEM;
- }
+ if (fb_alloc_cmap(&info->cmap, 256, 0))
+ goto out_unmap_regs;
- fb_set_cmap(&all->info.cmap, &all->info);
- tcx_init_fix(&all->info, linebytes);
+ fb_set_cmap(&info->cmap, info);
+ tcx_init_fix(info, linebytes);
- err = register_framebuffer(&all->info);
- if (err < 0) {
- fb_dealloc_cmap(&all->info.cmap);
- tcx_unmap_regs(op, all);
- kfree(all);
- return err;
- }
+ err = register_framebuffer(info);
+ if (err < 0)
+ goto out_dealloc_cmap;
- dev_set_drvdata(&op->dev, all);
+ dev_set_drvdata(&op->dev, info);
printk("%s: TCX at %lx:%lx, %s\n",
dp->full_name,
- all->par.which_io,
+ par->which_io,
op->resource[0].start,
- all->par.lowdepth ? "8-bit only" : "24-bit depth");
+ par->lowdepth ? "8-bit only" : "24-bit depth");
return 0;
+
+out_dealloc_cmap:
+ fb_dealloc_cmap(&info->cmap);
+
+out_unmap_regs:
+ tcx_unmap_regs(op, info, par);
+
+out_err:
+ return err;
}
static int __devinit tcx_probe(struct of_device *dev, const struct of_device_id *match)
@@ -502,14 +497,15 @@
static int __devexit tcx_remove(struct of_device *op)
{
- struct all_info *all = dev_get_drvdata(&op->dev);
+ struct fb_info *info = dev_get_drvdata(&op->dev);
+ struct tcx_par *par = info->par;
- unregister_framebuffer(&all->info);
- fb_dealloc_cmap(&all->info.cmap);
+ unregister_framebuffer(info);
+ fb_dealloc_cmap(&info->cmap);
- tcx_unmap_regs(op, all);
+ tcx_unmap_regs(op, info, par);
- kfree(all);
+ framebuffer_release(info);
dev_set_drvdata(&op->dev, NULL);