| Message ID | 20200107113031.435604-1-boris.brezillon@collabora.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check() | expand |
Hi Boris, Thank you for the patch. On Tue, Jan 07, 2020 at 12:30:31PM +0100, Boris Brezillon wrote: > drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's > bail out before derefencing the bridge pointer when that happens. > > Reported-by: Chris Wilson <chris@chris-wilson.co.uk> > Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook") > Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> > --- > drivers/gpu/drm/drm_bridge.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c > index da28967bc586..f6f020854e83 100644 > --- a/drivers/gpu/drm/drm_bridge.c > +++ b/drivers/gpu/drm/drm_bridge.c > @@ -941,15 +941,19 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge, > struct drm_connector_state *conn_state) > { > struct drm_connector *conn = conn_state->connector; > - struct drm_encoder *encoder = bridge->encoder; > + struct drm_encoder *encoder; > struct drm_bridge *iter; > int ret; > > + if (!bridge) > + return 0; > + > ret = drm_atomic_bridge_chain_select_bus_fmts(bridge, crtc_state, > conn_state); > if (ret) > return ret; > > + encoder = bridge->encoder; > list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { > int ret; >
Quoting Laurent Pinchart (2020-01-07 12:15:47) > Hi Boris, > > Thank you for the patch. > > On Tue, Jan 07, 2020 at 12:30:31PM +0100, Boris Brezillon wrote: > > drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's > > bail out before derefencing the bridge pointer when that happens. > > > > Reported-by: Chris Wilson <chris@chris-wilson.co.uk> > > Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook") > > Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> > > Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> CI is back to its normal grumpy self, Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> -Chris
diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index da28967bc586..f6f020854e83 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -941,15 +941,19 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge, struct drm_connector_state *conn_state) { struct drm_connector *conn = conn_state->connector; - struct drm_encoder *encoder = bridge->encoder; + struct drm_encoder *encoder; struct drm_bridge *iter; int ret; + if (!bridge) + return 0; + ret = drm_atomic_bridge_chain_select_bus_fmts(bridge, crtc_state, conn_state); if (ret) return ret; + encoder = bridge->encoder; list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { int ret;
drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's bail out before derefencing the bridge pointer when that happens. Reported-by: Chris Wilson <chris@chris-wilson.co.uk> Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook") Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> --- drivers/gpu/drm/drm_bridge.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)