From 9e01af8ef4475046c9935214257ba092fb0a61d4 Mon Sep 17 00:00:00 2001 From: Sandor Yu Date: Tue, 17 Oct 2017 19:13:23 +0800 Subject: [PATCH] MLK-16597: hdmi: Fix kernel dump issue Kernel will dump when CONFIG_CC_STACKPROTECTOR_STRONG is enable. [ 2.675537] CDN_API_HDMITX_Set_Mode_blocking ret = 0 [ 2.675550] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffff000008ad5a50 [ 2.675550] [ 2.675557] CPU: 2 PID: 1553 Comm: kworker/2:2 Not tainted 4.9.56-641868-gead64f8 #12 [ 2.675559] Hardware name: Freescale i.MX8MQ EVK (DT) [ 2.675576] Workqueue: events deferred_probe_work_func [ 2.675578] Call trace: [ 2.675587] [] dump_backtrace+0x0/0x1d0 [ 2.675594] [] show_stack+0x14/0x1c [ 2.675602] [] dump_stack+0x8c/0xac [ 2.675609] [] panic+0x13c/0x2a8 [ 2.675617] [] print_tainted+0x0/0xa4 [ 2.675624] [] Afe_write+0x0/0x50 [ 2.675632] [] hdmi_init.constprop.3+0x188/0x1d0 [ 2.675638] [] imx_hdmi_probe+0x22c/0x2ac [ 2.675645] [] platform_drv_probe+0x50/0xc8 [ 2.675650] [] driver_probe_device+0x218/0x2b8 [ 2.675655] [] __device_attach_driver+0x98/0xe8 [ 2.675660] [] bus_for_each_drv+0x60/0xb0 [ 2.675665] [] __device_attach+0xd4/0x128 [ 2.675669] [] device_initial_probe+0x10/0x18 [ 2.675674] [] bus_probe_device+0x90/0x98 [ 2.675679] [] deferred_probe_work_func+0x7c/0xb0 [ 2.675685] [] process_one_work+0x144/0x434 [ 2.675690] [] worker_thread+0x200/0x4a4 [ 2.675696] [] kthread+0xf0/0x104 [ 2.675701] [] ret_from_fork+0x10/0x50 It is cause by array variable access exceed. Fixed it with correct array size. Signed-off-by: Sandor Yu --- drivers/mxc/hdp/API_AVI.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/mxc/hdp/API_AVI.c b/drivers/mxc/hdp/API_AVI.c index bc2c2082d29b..eceb9e17f6e5 100644 --- a/drivers/mxc/hdp/API_AVI.c +++ b/drivers/mxc/hdp/API_AVI.c @@ -69,8 +69,8 @@ CDN_API_STATUS CDN_API_Set_AVI(state_struct *state, VIC_MODES vicMode, u32 packet_R = 0; u32 packet_VIC = 0; u32 packet_PR = 0; - u32 packet_buf[18 / sizeof(u32)]; - u8 *packet = (u8 *) &packet_buf[0]; + u8 packet[32]; + u8 len = sizeof(packet)/sizeof(u32); u32 packet_HB0 = 0; u32 packet_HB1 = 0; u32 packet_HB2 = 0; @@ -181,7 +181,7 @@ CDN_API_STATUS CDN_API_Set_AVI(state_struct *state, VIC_MODES vicMode, packet[16] = packet_PB12; packet[17] = packet_PB13; - CDN_API_InfoframeSet(state, 0, packet_len, &packet_buf[0], packet_type); + CDN_API_InfoframeSet(state, 0, len, (u32 *)&packet[0], packet_type); return CDN_OK; } -- 2.17.1