From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
To: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Gustavo Padovan <gustavo.padovan@collabora.com>,
Daniel Vetter <daniel.vetter@ffwll.ch>,
Jani Nikula <jani.nikula@linux.intel.com>,
David Airlie <airlied@linux.ie>,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Subject: [next] drm/atomic: NULL pointer dereference
Date: Tue, 26 Sep 2017 16:59:45 +0900 [thread overview]
Message-ID: <20170926075945.GA364@jagdpanzerIV.localdomain> (raw)
Hello,
after commit 669c9215afea4e ("drm/atomic: Make async plane update
checks work as intended") drm_atomic_helper_async_check() can NULL
deference the `new_plane_state' pointer and crashe the kernel at
'new_plane_state->crtc':
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: drm_atomic_helper_async_check+0x70/0xcb
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP
[..]
task: ffff880131ac2280 task.stack: ffffc90000464000
RIP: 0010:drm_atomic_helper_async_check+0x70/0xcb
RSP: 0018:ffffc90000467a48 EFLAGS: 00010246
RAX: ffff880131917b60 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffff880131753480 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000010000
R10: ffff880130d3255c R11: ffff880130e56e18 R12: ffff880131670000
R13: 0000000000000000 R14: ffff880131670000 R15: 0000000000000004
FS: 00007fc218f6e940(0000) GS:ffff880137d80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 0000000132aca000 CR4: 00000000000006e0
Call Trace:
drm_atomic_helper_check+0x3c/0x5a
nv50_disp_atomic_check+0x15/0x10b
drm_atomic_check_only+0x2c0/0x42a
drm_atomic_commit+0x13/0x4d
drm_atomic_helper_update_plane+0xc9/0xe6
__setplane_internal+0x1c8/0x229
? drm_internal_framebuffer_create+0x314/0x35a
drm_mode_cursor_universal+0x130/0x15f
drm_mode_cursor_common+0xcc/0x184
? drm_mode_setplane+0x183/0x183
drm_mode_cursor_ioctl+0x2f/0x34
drm_ioctl_kernel+0x61/0x9a
drm_ioctl+0x1d6/0x2a8
? drm_mode_setplane+0x183/0x183
? _raw_spin_unlock+0x12/0x23
? do_wp_page+0x159/0x22e
? _raw_spin_unlock_irqrestore+0x14/0x25
nouveau_drm_ioctl+0x71/0xa4
vfs_ioctl+0x1b/0x28
do_vfs_ioctl+0x5a9/0x5bc
? handle_mm_fault+0x98/0x9e
? __fget+0x5d/0x67
SyS_ioctl+0x3e/0x5a
entry_SYSCALL_64_fastpath+0x13/0x94
the below patch fixes the issues for me.
---
drivers/gpu/drm/drm_atomic_helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 01c34bc5b5b0..922f4d3b17aa 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1405,7 +1405,7 @@ int drm_atomic_helper_async_check(struct drm_device *dev,
if (n_planes != 1)
return -EINVAL;
- if (!new_plane_state->crtc)
+ if (!new_plane_state || !new_plane_state->crtc)
return -EINVAL;
funcs = plane->helper_private;
--
2.14.1
reply other threads:[~2017-09-26 7:59 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170926075945.GA364@jagdpanzerIV.localdomain \
--to=sergey.senozhatsky.work@gmail.com \
--cc=airlied@linux.ie \
--cc=daniel.vetter@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=gustavo.padovan@collabora.com \
--cc=jani.nikula@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maarten.lankhorst@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®