lkml.org 
[lkml]   [2016]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] drm/cirrus: Fix NULL pointer dereference when registering the fbdev
Boris Brezillon <boris.brezillon@free-electrons.com> writes:

> cirrus_modeset_init() is initializing/registering the emulated fbdev
> and, since commit c61b93fe51b1 ("drm/atomic: Fix remaining places where
> !funcs->best_encoder is valid"), DRM internals can access/test some of
> the fields in mode_config->funcs as part of the fbdev registration
> process.
> Make sure dev->mode_config.funcs is properly set to avoid dereferencing
> a NULL pointer.

That fixes the issues I am seeing.

Tested-by: "Eric W. Biederman" <ebiederm@xmission.com>

> Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
> Fixes: c61b93fe51b1 ("drm/atomic: Fix remaining places where !funcs->best_encoder is valid")
> ---
> Hi Dave,
>
> As discussed on IRC, I'm sending this patch in a proper format. That's
> probably better to wait for Eric's feeback before applying it though.

It is weird I didn't see either of your email messages directly only
through lkml. Weird.

> Regards,
>
> Boris
> ---
> drivers/gpu/drm/cirrus/cirrus_main.c | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/cirrus/cirrus_main.c b/drivers/gpu/drm/cirrus/cirrus_main.c
> index 80446e2d3ab6..76bcb43e7c06 100644
> --- a/drivers/gpu/drm/cirrus/cirrus_main.c
> +++ b/drivers/gpu/drm/cirrus/cirrus_main.c
> @@ -185,14 +185,23 @@ int cirrus_driver_load(struct drm_device *dev, unsigned long flags)
> goto out;
> }
>
> + /*
> + * cirrus_modeset_init() is initializing/registering the emulated fbdev
> + * and DRM internals can access/test some of the fields in
> + * mode_config->funcs as part of the fbdev registration process.
> + * Make sure dev->mode_config.funcs is properly set to avoid
> + * dereferencing a NULL pointer.
> + * FIXME: mode_config.funcs assignment should probably be done in
> + * cirrus_modeset_init() (that's a common pattern seen in other DRM
> + * drivers).
> + */
> + dev->mode_config.funcs = &cirrus_mode_funcs;
> r = cirrus_modeset_init(cdev);
> if (r) {
> dev_err(&dev->pdev->dev, "Fatal error during modeset init: %d\n", r);
> goto out;
> }
>
> - dev->mode_config.funcs = (void *)&cirrus_mode_funcs;
> -
> return 0;
> out:
> cirrus_driver_unload(dev);

\
 
 \ /
  Last update: 2016-08-09 06:42    [W:0.367 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site