Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1458334

[PATCH] drm/cirrus: Fix NULL pointer dereference when registering the fbdev

Show all headers | View raw

cirrus_modeset_init() is initializing/registering the emulated fbdev
and, since commit c61b93fe51b1 ("drm/atomic: Fix remaining places where
!funcs->best_encoder is valid"), DRM internals can access/test some of
the fields in mode_config->funcs as part of the fbdev registration
process.
Make sure dev->mode_config.funcs is properly set to avoid dereferencing
a NULL pointer.

Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Fixes: c61b93fe51b1 ("drm/atomic: Fix remaining places where !funcs->best_encoder is valid")
---
Hi Dave,

As discussed on IRC, I'm sending this patch in a proper format. That's
probably better to wait for Eric's feeback before applying it though.

Regards,

Boris
---
 drivers/gpu/drm/cirrus/cirrus_main.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/cirrus/cirrus_main.c b/drivers/gpu/drm/cirrus/cirrus_main.c
index 80446e2d3ab6..76bcb43e7c06 100644
--- a/drivers/gpu/drm/cirrus/cirrus_main.c
+++ b/drivers/gpu/drm/cirrus/cirrus_main.c
@@ -185,14 +185,23 @@ int cirrus_driver_load(struct drm_device *dev, unsigned long flags)
 		goto out;
 	}
 
+	/*
+	 * cirrus_modeset_init() is initializing/registering the emulated fbdev
+	 * and DRM internals can access/test some of the fields in
+	 * mode_config->funcs as part of the fbdev registration process.
+	 * Make sure dev->mode_config.funcs is properly set to avoid
+	 * dereferencing a NULL pointer.
+	 * FIXME: mode_config.funcs assignment should probably be done in
+	 * cirrus_modeset_init() (that's a common pattern seen in other DRM
+	 * drivers).
+	 */
+	dev->mode_config.funcs = &cirrus_mode_funcs;
 	r = cirrus_modeset_init(cdev);
 	if (r) {
 		dev_err(&dev->pdev->dev, "Fatal error during modeset init: %d\n", r);
 		goto out;
 	}
 
-	dev->mode_config.funcs = (void *)&cirrus_mode_funcs;
-
 	return 0;
 out:
 	cirrus_driver_unload(dev);
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Linux 4.8-rc1 Linus Torvalds <torvalds@linux-foundation.org> - 2016-08-08 03:50 +0200
  Re: Linux 4.8-rc1 Cirrus QEMU crashes on boot. Linus Torvalds <torvalds@linux-foundation.org> - 2016-08-08 23:20 +0200
    Re: Linux 4.8-rc1 Cirrus QEMU crashes on boot. David Airlie <airlied@redhat.com> - 2016-08-09 00:00 +0200
      [PATCH] drm/cirrus: Fix NULL pointer dereference when registering the fbdev Boris Brezillon <boris.brezillon@free-electrons.com> - 2016-08-09 02:20 +0200
        Re: [PATCH] drm/cirrus: Fix NULL pointer dereference when registering the fbdev ebiederm@xmission.com (Eric W. Biederman) - 2016-08-09 05:50 +0200
          Re: [PATCH] drm/cirrus: Fix NULL pointer dereference when  registering the fbdev Boris Brezillon <boris.brezillon@free-electrons.com> - 2016-08-09 10:10 +0200
    Re: Linux 4.8-rc1 Cirrus QEMU crashes on boot. Boris Brezillon <boris.brezillon@free-electrons.com> - 2016-08-09 00:10 +0200
  linux-next: stats (Was: Linux 4.8-rc1) Stephen Rothwell <sfr@canb.auug.org.au> - 2016-08-09 02:20 +0200

csiph-web