drm/tegra: Fix window[0] base address corruption
authorDmitry Osipenko <digetx@gmail.com>
Sun, 21 Aug 2016 08:57:58 +0000 (11:57 +0300)
committerThierry Reding <treding@nvidia.com>
Wed, 24 Aug 2016 14:15:09 +0000 (16:15 +0200)
commit08ee01789eebf433c27e8b3eecc3ddbb5f7c4d51
tree9a7d2b848fd71043a3c3bc69b4885d82ec78716e
parent87904c3e82319cf2bad8d656d79c5030dab9490e
drm/tegra: Fix window[0] base address corruption

Window uses shared stride for UV planes and tegra_dc_window struct
defines array of 2 strides per window. That's not taken in account
during setting up of the window addresses and strides, resulting in
out-of-bounds write of the 3-rd (non-existent) V plane stride that
overwrites Y plane base address.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
[treding@nvidia.com: explain why the V-plane stride is ignored]
Signed-off-by: Thierry Reding <treding@nvidia.com>
drivers/gpu/drm/tegra/dc.c