Patchwork [3.5.y.z,extended,stable] Patch "video: mxsfb: fix crash when unblanking the display" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Jan. 15, 2013, 10:21 p.m.
Message ID <>
Download mbox | patch
Permalink /patch/212334/
State New
Headers show


Herton Ronaldo Krzesinski - Jan. 15, 2013, 10:21 p.m.
This is a note to let you know that I have just added a patch titled

    video: mxsfb: fix crash when unblanking the display

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 12b012e4bbf85cfce419a2f9ede93b9db7ebf41e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lothar=20Wa=C3=9Fmann?= <>
Date: Thu, 22 Nov 2012 13:49:14 +0100
Subject: [PATCH] video: mxsfb: fix crash when unblanking the display
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 6c1ecba8d84841277d68140ef485335d5be28485 upstream.

The VDCTRL4 register does not provide the MXS SET/CLR/TOGGLE feature.
The write in mxsfb_disable_controller() sets the data_cnt for the LCD
DMA to 0 which obviously means the max. count for the LCD DMA and
leads to overwriting arbitrary memory when the display is unblanked.

Signed-off-by: Lothar WaƟmann <>
Acked-by: Juergen Beisert <>
Tested-by: Lauri Hintsala <>
Signed-off-by: Shawn Guo <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 drivers/video/mxsfb.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)



diff --git a/drivers/video/mxsfb.c b/drivers/video/mxsfb.c
index abbe691..fc2c4381 100644
--- a/drivers/video/mxsfb.c
+++ b/drivers/video/mxsfb.c
@@ -367,7 +367,8 @@  static void mxsfb_disable_controller(struct fb_info *fb_info)

-	writel(VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4 + REG_CLR);
+	reg = readl(host->base + LCDC_VDCTRL4);
+	writel(reg & ~VDCTRL4_SYNC_SIGNALS_ON, host->base + LCDC_VDCTRL4);