From patchwork Sat Jun 1 02:43:27 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhinav Kumar X-Patchwork-Id: 10971163 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0FCBB14C0 for ; Sat, 1 Jun 2019 02:43:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 01E3D28D97 for ; Sat, 1 Jun 2019 02:43:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EA00A28D9B; Sat, 1 Jun 2019 02:43:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 9D0A328D97 for ; Sat, 1 Jun 2019 02:43:40 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 241EE89A9F; Sat, 1 Jun 2019 02:43:38 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from smtp.codeaurora.org (smtp.codeaurora.org [198.145.29.96]) by gabe.freedesktop.org (Postfix) with ESMTPS id DDF9389A9F for ; Sat, 1 Jun 2019 02:43:36 +0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 9AFCC60C72; Sat, 1 Jun 2019 02:43:36 +0000 (UTC) Received: from abhinavk-linux.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: abhinavk@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 8CFBB60312; Sat, 1 Jun 2019 02:43:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 8CFBB60312 From: Abhinav Kumar To: dri-devel@lists.freedesktop.org Subject: [PATCH v2] drm/msm/dsi: add protection against NULL dsi device Date: Fri, 31 May 2019 19:43:27 -0700 Message-Id: <1559357007-21004-1-git-send-email-abhinavk@codeaurora.org> X-Mailer: git-send-email 1.9.1 X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1559357016; bh=EIGdHRTGMSH8BrR4fNTW/L7YHCj/dHmkgWPz/8baTkk=; h=From:To:Cc:Subject:Date:From; b=kzjqUEITrbZXR8nDM/ieBr3arNCD85iak0qOLuY92dXcPaNvKxX+Erwn5ygm+JQ7n neSiKTiSVcdphc/E3JsaM4mbLcU+Bv/Mi90VrG5Jz+xGVuRrZlF+PQN1J2C5qILLEy hU2+eNlNXaIYyLux0nz5I+X0n5HUylmh4ErqFrA4= X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1559357015; bh=EIGdHRTGMSH8BrR4fNTW/L7YHCj/dHmkgWPz/8baTkk=; h=From:To:Cc:Subject:Date:From; b=FaulWKHrxQedjqxTPLe7lPVM3Ogjdr7ayPTSHSYQ9X/dQs5BadNcsH14fFIEFH2E1 P+h8Q4MiYuATcH54SupiS9EeHuQlCYuiahOVeqh9EkWryU7B+w+t+Ac8Ol5CwGb+et CIV57FL+ART+JjJa95Jbtpw3gR7uyXSKfOJ4UgKs= X-Mailman-Original-Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org X-Mailman-Original-Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=abhinavk@codeaurora.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-arm-msm@vger.kernel.org, Abhinav Kumar , seanpaul@chromium.org, hoegsberg@google.com, chandanu@codeaurora.org MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP When panel probe happens after DSI probe, the DSI probe is deferred as per current design. In the probe defer path dsi device is destroyed. This NULL dsi device could be deferenced by the panel probe in the mipi_dsi_attach path. Check for NULL dsi device before accessing it. Changes in v2: - Add more comments on how this NULL pointer situation will be hit Reported-by: Jeffrey Hugo Tested-by: Jeffrey Hugo Signed-off-by: Abhinav Kumar --- drivers/gpu/drm/msm/dsi/dsi_manager.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c index 80aa634..8fcb13f 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_manager.c +++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c @@ -769,7 +769,7 @@ bool msm_dsi_manager_cmd_xfer_trigger(int id, u32 dma_base, u32 len) void msm_dsi_manager_attach_dsi_device(int id, u32 device_flags) { struct msm_dsi *msm_dsi = dsi_mgr_get_dsi(id); - struct drm_device *dev = msm_dsi->dev; + struct drm_device *dev; struct msm_drm_private *priv; struct msm_kms *kms; struct drm_encoder *encoder; @@ -781,7 +781,17 @@ void msm_dsi_manager_attach_dsi_device(int id, u32 device_flags) * (generally the case when we're connected to a drm_panel of the type * mipi_dsi_device), this would be NULL. In such cases, try to set the * encoder mode in the DSI connector's detect() op. + * + * msm_dsi pointer is assigned to a valid dsi device only when + * msm_dsi_manager_register() succeeds. When panel hasnt probed yet + * dsi_mgr_setup_components() could potentially return -EDEFER and + * assign the msm_dsi->dev to NULL. When the panel now probes and calls + * mipi_dsi_attach(), this will call msm_dsi_manager_attach_dsi_device() + * which will result in a NULL pointer dereference */ + + dev = msm_dsi ? msm_dsi->dev : NULL; + if (!dev) return;