Separate alpha formats need a companion IDMAC channel, which only the
graphics (DP) channels have. ipu_channel_alpha_channel() has no case for
IPUV3_CHANNEL_MEM_DC_SYNC, so ipu_plane_get_resources() leaves alpha_ch
at NULL for planes on the DC path. Yet ipu_plane_rgb_formats[], used for
exactly those planes, still advertises the six *_A8 fourccs.
Userspace picking one of them gets past ipu_plane_atomic_check(), which
never looks at alpha_ch, and ipu_plane_atomic_update() then dereferences
the NULL channel in ipu_cpmem_zero(). On i.MX53 this is reachable from
any client scanning out on DI1.
Drop the separate alpha formats from the RGB list.
Fixes: f6b50ef14ea8 ("drm/imx: ipuv3-plane: add support for separate alpha
planes")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Dmitry Baryshkov <[email protected]>
---
drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
index c7ec09e557c1..a0fd39eebbbc 100644
--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-plane.c
@@ -96,12 +96,6 @@ static const uint32_t ipu_plane_rgb_formats[] = {
DRM_FORMAT_BGRA8888,
DRM_FORMAT_BGRX8888,
DRM_FORMAT_RGB565,
- DRM_FORMAT_RGB565_A8,
- DRM_FORMAT_BGR565_A8,
- DRM_FORMAT_RGB888_A8,
- DRM_FORMAT_BGR888_A8,
- DRM_FORMAT_RGBX8888_A8,
- DRM_FORMAT_BGRX8888_A8,
};
static const uint64_t ipu_format_modifiers[] = {
--
2.47.3
