From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752512AbcHIDtn (ORCPT ); Mon, 8 Aug 2016 23:49:43 -0400 Received: from out02.mta.xmission.com ([166.70.13.232]:58530 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752265AbcHIDtl (ORCPT ); Mon, 8 Aug 2016 23:49:41 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Boris Brezillon Cc: David Airlie , Daniel Vetter , dri-devel@lists.freedesktop.org, Linus Torvalds , linux-kernel@vger.kernel.org References: <127976560.342868.1470693556296.JavaMail.zimbra@redhat.com> <1470701778-20839-1-git-send-email-boris.brezillon@free-electrons.com> Date: Mon, 08 Aug 2016 22:36:13 -0500 In-Reply-To: <1470701778-20839-1-git-send-email-boris.brezillon@free-electrons.com> (Boris Brezillon's message of "Tue, 9 Aug 2016 02:16:18 +0200") Message-ID: <87a8gmliky.fsf@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1bWy2f-00023r-R1;;;mid=<87a8gmliky.fsf@x220.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=67.3.204.119;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/+WiGYYKFct9IlP+xlzBNgO0GZny4Jj8I= X-SA-Exim-Connect-IP: 67.3.204.119 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.7 XMSubLong Long Subject * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 2.0 XMFreeBegin URI: free-something.com * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa07 1397; Body=1 Fuz1=1 Fuz2=1] * 1.0 T_XMDrugObfuBody_12 obfuscated drug references X-Spam-DCC: XMission; sa07 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ***;Boris Brezillon X-Spam-Relay-Country: X-Spam-Timing: total 1057 ms - load_scoreonly_sql: 0.06 (0.0%), signal_user_changed: 4.4 (0.4%), b_tie_ro: 3.2 (0.3%), parse: 1.04 (0.1%), extract_message_metadata: 17 (1.6%), get_uri_detail_list: 1.77 (0.2%), tests_pri_-1000: 7 (0.7%), tests_pri_-950: 1.27 (0.1%), tests_pri_-900: 1.06 (0.1%), tests_pri_-400: 34 (3.2%), check_bayes: 32 (3.1%), b_tokenize: 7 (0.6%), b_tok_get_all: 7 (0.7%), b_comp_prob: 2.5 (0.2%), b_tok_touch_all: 13 (1.3%), b_finish: 0.87 (0.1%), tests_pri_0: 220 (20.9%), check_dkim_signature: 0.71 (0.1%), check_dkim_adsp: 3.8 (0.4%), tests_pri_500: 766 (72.5%), poll_dns_idle: 757 (71.7%), rewrite_mail: 0.00 (0.0%) Subject: Re: [PATCH] drm/cirrus: Fix NULL pointer dereference when registering the fbdev X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Boris Brezillon writes: > cirrus_modeset_init() is initializing/registering the emulated fbdev > and, since commit c61b93fe51b1 ("drm/atomic: Fix remaining places where > !funcs->best_encoder is valid"), DRM internals can access/test some of > the fields in mode_config->funcs as part of the fbdev registration > process. > Make sure dev->mode_config.funcs is properly set to avoid dereferencing > a NULL pointer. That fixes the issues I am seeing. Tested-by: "Eric W. Biederman" > Signed-off-by: Boris Brezillon > Fixes: c61b93fe51b1 ("drm/atomic: Fix remaining places where !funcs->best_encoder is valid") > --- > Hi Dave, > > As discussed on IRC, I'm sending this patch in a proper format. That's > probably better to wait for Eric's feeback before applying it though. It is weird I didn't see either of your email messages directly only through lkml. Weird. > Regards, > > Boris > --- > drivers/gpu/drm/cirrus/cirrus_main.c | 13 +++++++++++-- > 1 file changed, 11 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/cirrus/cirrus_main.c b/drivers/gpu/drm/cirrus/cirrus_main.c > index 80446e2d3ab6..76bcb43e7c06 100644 > --- a/drivers/gpu/drm/cirrus/cirrus_main.c > +++ b/drivers/gpu/drm/cirrus/cirrus_main.c > @@ -185,14 +185,23 @@ int cirrus_driver_load(struct drm_device *dev, unsigned long flags) > goto out; > } > > + /* > + * cirrus_modeset_init() is initializing/registering the emulated fbdev > + * and DRM internals can access/test some of the fields in > + * mode_config->funcs as part of the fbdev registration process. > + * Make sure dev->mode_config.funcs is properly set to avoid > + * dereferencing a NULL pointer. > + * FIXME: mode_config.funcs assignment should probably be done in > + * cirrus_modeset_init() (that's a common pattern seen in other DRM > + * drivers). > + */ > + dev->mode_config.funcs = &cirrus_mode_funcs; > r = cirrus_modeset_init(cdev); > if (r) { > dev_err(&dev->pdev->dev, "Fatal error during modeset init: %d\n", r); > goto out; > } > > - dev->mode_config.funcs = (void *)&cirrus_mode_funcs; > - > return 0; > out: > cirrus_driver_unload(dev);