[PATCH] fbdev: Fix NULL-ptr dereference in pm2fb_probe

From: Jim Hague <jim.hague@acm.org>

It fixes the NULL pointer dereference and also a problem in pm2fb_blank().

drivers/video/pm2fb.c

@@ -62,6 +62,16 @@
 #define DPRINTK(a,b...)
 #endif
 
+/*
+ * The 2.4 driver calls reset_card() at init time, where it also sets the
+ * initial mode. I don't think the driver should touch the chip until
+ * the console sets a video mode. So I was calling this at the start
+ * of setting a mode. However, certainly on 1280x1024 depth 16 on my
+ * PCI Graphics Blaster Exxtreme this causes the display to smear
+ * slightly.  I don't know why. Guesses to jim.hague@acm.org.
+ */
+#undef RESET_CARD_ON_MODE_SET
+
 /*
  * Driver data 
  */
@@ -340,16 +350,7 @@ static void clear_palette(struct pm2fb_par* p) {
 	}
 }
 
-#if 0
-/*
- * FIXME:
- * The 2.4 driver calls this at init time, where it also sets the
- * initial mode. I don't think the driver should touch the chip
- * until the console sets a video mode. So I was calling this
- * at the start of setting a mode. However, certainly on 1280x1024
- * depth 16 this causes the display to smear slightly.
- * I don't know why. Guesses to jim.hague@acm.org.
- */
+#ifdef RESET_CARD_ON_MODE_SET
 static void reset_card(struct pm2fb_par* p)
 {
 	if (p->type == PM2_TYPE_PERMEDIA2V)
@@ -501,6 +502,8 @@ static void set_video(struct pm2fb_par* p, u32 video) {
 	u32 vsync;
 
 	vsync = video;
+
+	DPRINTK("video = 0x%x\n", video);
 	
 	/*
 	 * The hardware cursor needs +vsync to recognise vert retrace.
@@ -660,6 +663,9 @@ static int pm2fb_set_par(struct fb_info *info)
 	u32 xres;
 	int data64;
 
+#ifdef RESET_CARD_ON_MODE_SET
+	reset_card(par);
+#endif
 	reset_config(par);
 	clear_palette(par);
     
@@ -721,8 +727,7 @@ static int pm2fb_set_par(struct fb_info *info)
 
 	info->fix.visual =
 		(depth == 8) ? FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_TRUECOLOR;
-	info->fix.line_length =
-		info->var.xres * ((info->var.bits_per_pixel + 7) >> 3);
+	info->fix.line_length = info->var.xres * depth / 8;
 	info->cmap.len = 256;
 
 	/*
@@ -803,6 +808,8 @@ static int pm2fb_set_par(struct fb_info *info)
 		break;
 	}
 	set_pixclock(par, pixclock);
+	DPRINTK("Setting graphics mode at %dx%d depth %d\n",
+		info->var.xres, info->var.yres, info->var.bits_per_pixel);
 	return 0;	
 }
 
@@ -843,7 +850,8 @@ static int pm2fb_setcolreg(unsigned regno, unsigned red, unsigned green,
 	 *   var->{color}.offset contains start of bitfield
 	 *   var->{color}.length contains length of bitfield
 	 *   {hardwarespecific} contains width of DAC
-	 *   cmap[X] is programmed to (X << red.offset) | (X << green.offset) | (X << blue.offset)
+	 *   cmap[X] is programmed to
+	 *   (X << red.offset) | (X << green.offset) | (X << blue.offset)
 	 *   RAMDAC[X] is programmed to (red, green, blue)
 	 *
 	 * Pseudocolor:
@@ -856,8 +864,9 @@ static int pm2fb_setcolreg(unsigned regno, unsigned red, unsigned green,
 	 *    does not use RAMDAC (usually has 3 of them).
 	 *    var->{color}.offset contains start of bitfield
 	 *    var->{color}.length contains length of bitfield
-	 *    cmap is programmed to (red << red.offset) | (green << green.offset) |
-	 *                      (blue << blue.offset) | (transp << transp.offset)
+	 *    cmap is programmed to
+	 *    (red << red.offset) | (green << green.offset) |
+	 *    (blue << blue.offset) | (transp << transp.offset)
 	 *    RAMDAC does not exist
 	 */
 #define CNVT_TOHW(val,width) ((((val)<<(width))+0x7FFF-(val))>>16)
@@ -962,6 +971,11 @@ static int pm2fb_blank(int blank_mode, struct fb_info *info)
 	struct pm2fb_par *par = (struct pm2fb_par *) info->par;
 	u32 video = par->video;
 
+	DPRINTK("blank_mode %d\n", blank_mode);
+
+	/* Turn everything on, then disable as requested. */
+	video |= (PM2F_VIDEO_ENABLE | PM2F_HSYNC_MASK | PM2F_VSYNC_MASK);
+
 	switch (blank_mode) {
 	case 0: 	/* Screen: On; HSync: On, VSync: On */
 		break;
@@ -1030,15 +1044,12 @@ static int __devinit pm2fb_probe(struct pci_dev *pdev,
 		return err;
 	}
 
-	size = sizeof(struct fb_info) + sizeof(struct pm2fb_par) + 256 * sizeof(u32);
-
+	size = sizeof(struct pm2fb_par) + 256 * sizeof(u32);
 	info = framebuffer_alloc(size, &pdev->dev);
 	if ( !info )
 		return -ENOMEM;
-	memset(info, 0, size);
-    
-	default_par = info->par;
- 
+	default_par = (struct pm2fb_par *) info->par;
+
 	switch (pdev->device) {
 	case  PCI_DEVICE_ID_TI_TVP4020:
 		strcpy(pm2fb_fix.id, "TVP4020");
@@ -1112,7 +1123,6 @@ static int __devinit pm2fb_probe(struct pci_dev *pdev,
 
 	info->fbops		= &pm2fb_ops;
 	info->fix		= pm2fb_fix; 	
-	info->par		= default_par;
 	info->pseudo_palette	= (void *)(default_par + 1); 
 	info->flags		= FBINFO_FLAG_DEFAULT;