drm: rcar-du: Fix crash with groups that have less than 9 planes
Commit 917de180379d ("drm: rcar-du: Implement universal plane support")
made the number of planes per group dynamic, but didn't update all loops
over the planes array, resulting in out-of-bound accesses on DU
instances that have an odd number of CRTCs (such as the R8A7790). Fix
it.
Fixes: 917de180379d ("drm: rcar-du: Implement universal plane support")
Cc: stable@vger.kernel.org
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_plane.c b/drivers/gpu/drm/rcar-du/rcar_du_plane.c
index 3e30d84..d90dc428 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_plane.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_plane.c
@@ -390,7 +390,6 @@
int rcar_du_planes_init(struct rcar_du_group *rgrp)
{
struct rcar_du_device *rcdu = rgrp->dev;
- unsigned int num_planes;
unsigned int crtcs;
unsigned int i;
int ret;
@@ -398,11 +397,11 @@
/* Create one primary plane per CRTC in this group and seven overlay
* planes.
*/
- num_planes = rgrp->num_crtcs + 7;
+ rgrp->num_planes = rgrp->num_crtcs + 7;
crtcs = ((1 << rcdu->num_crtcs) - 1) & (3 << (2 * rgrp->index));
- for (i = 0; i < num_planes; ++i) {
+ for (i = 0; i < rgrp->num_planes; ++i) {
enum drm_plane_type type = i < rgrp->num_crtcs
? DRM_PLANE_TYPE_PRIMARY
: DRM_PLANE_TYPE_OVERLAY;