Attachment 50441 Details for Bug 40005 – fix

[patch] fix

0001-drm-nv50-crtc-Bail-out-if-FB-is-not-bound-to-crtc.patch (text/plain), 1.81 KB, created by Emil Velikov on 2011-08-21 14:46:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Emil Velikov

Created: 2011-08-21 14:46:32 UTC

Size: 1.81 KB

patch

obsolete

>From 7124882caac17b1d5de7eed9faf2ad5cfd2f07aa Mon Sep 17 00:00:00 2001
>From: Emil Velikov <emil.l.velikov@gmail.com>
>Date: Sun, 21 Aug 2011 22:41:28 +0100
>Subject: [PATCH] drm/nv50/crtc: Bail out if FB is not bound to crtc
>
>Fixes possbile NULL pointer dereference
>Resolves 'kernel crash in nv50_crtc_do_mode_set_base during shutdown'
>https://bugs.freedesktop.org/show_bug.cgi?id=40005
>
>Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
>---
> drivers/gpu/drm/nouveau/nv50_crtc.c |   12 ++++++++++--
> 1 files changed, 10 insertions(+), 2 deletions(-)
>
>diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
>index 636e3fb..882080e 100644
>--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
>+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
>@@ -517,12 +517,18 @@ nv50_crtc_do_mode_set_base(struct drm_crtc *crtc,
> 	struct drm_device *dev = nv_crtc->base.dev;
> 	struct drm_nouveau_private *dev_priv = dev->dev_private;
> 	struct nouveau_channel *evo = nv50_display(dev)->master;
>-	struct drm_framebuffer *drm_fb = nv_crtc->base.fb;
>-	struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
>+	struct drm_framebuffer *drm_fb;
>+	struct nouveau_framebuffer *fb;
> 	int ret;
> 
> 	NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
> 
>+	/* no fb bound */
>+	if (!atomic && !crtc->fb) {
>+		NV_DEBUG_KMS(dev, "No FB bound\n");
>+		return 0;
>+	}
>+
> 	/* If atomic, we want to switch to the fb we were passed, so
> 	 * now we update pointers to do that.  (We don't pin; just
> 	 * assume we're already pinned and update the base address.)
>@@ -531,6 +537,8 @@ nv50_crtc_do_mode_set_base(struct drm_crtc *crtc,
> 		drm_fb = passed_fb;
> 		fb = nouveau_framebuffer(passed_fb);
> 	} else {
>+		drm_fb = crtc->fb;
>+		fb = nouveau_framebuffer(crtc->fb);
> 		/* If not atomic, we can go ahead and pin, and unpin the
> 		 * old fb we were passed.
> 		 */
>-- 
>1.7.6
>

Actions: View | Splinter Review

Attachments on bug 40005: 50121 | 50441

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.