From patchwork Tue Jan 7 11:30:31 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Boris Brezillon X-Patchwork-Id: 11320779 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DDBAF139A for ; Tue, 7 Jan 2020 11:30:41 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C5EF02077B for ; Tue, 7 Jan 2020 11:30:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C5EF02077B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=collabora.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id CFDFB89B00; Tue, 7 Jan 2020 11:30:39 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e3e3]) by gabe.freedesktop.org (Postfix) with ESMTPS id 5A4DB89B00; Tue, 7 Jan 2020 11:30:37 +0000 (UTC) Received: from localhost.localdomain (unknown [IPv6:2a01:e0a:2c:6930:5cf4:84a1:2763:fe0d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: bbrezillon) by bhuna.collabora.co.uk (Postfix) with ESMTPSA id 428C5281ED5; Tue, 7 Jan 2020 11:30:36 +0000 (GMT) From: Boris Brezillon To: Andrzej Hajda , Neil Armstrong , Laurent Pinchart , Jonas Karlman , Jernej Skrabec Subject: [PATCH] drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check() Date: Tue, 7 Jan 2020 12:30:31 +0100 Message-Id: <20200107113031.435604-1-boris.brezillon@collabora.com> X-Mailer: git-send-email 2.23.0 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: intel-gfx-trybot@lists.freedesktop.org, Boris Brezillon , dri-devel@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's bail out before derefencing the bridge pointer when that happens. Reported-by: Chris Wilson Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook") Signed-off-by: Boris Brezillon Reviewed-by: Laurent Pinchart Reviewed-by: Chris Wilson --- drivers/gpu/drm/drm_bridge.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c index da28967bc586..f6f020854e83 100644 --- a/drivers/gpu/drm/drm_bridge.c +++ b/drivers/gpu/drm/drm_bridge.c @@ -941,15 +941,19 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge, struct drm_connector_state *conn_state) { struct drm_connector *conn = conn_state->connector; - struct drm_encoder *encoder = bridge->encoder; + struct drm_encoder *encoder; struct drm_bridge *iter; int ret; + if (!bridge) + return 0; + ret = drm_atomic_bridge_chain_select_bus_fmts(bridge, crtc_state, conn_state); if (ret) return ret; + encoder = bridge->encoder; list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { int ret;