Commit 8fa6eb03 authored Mar 27, 2022 by Xiaomeng Tong Committed by Greg Kroah-Hartman Jun 14, 2022

drm/nouveau/clk: Fix an incorrect NULL check on list iterator



commit 1c3b2a27def609473ed13b1cd668cb10deab49b4 upstream.

The bug is here:
	if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp))
		return cstate;

The list iterator value 'cstate' will *always* be set and non-NULL
by list_for_each_entry_from_reverse(), so it is incorrect to assume
that the iterator value will be unchanged if the list is empty or no
element is found (In fact, it will be a bogus pointer to an invalid
structure object containing the HEAD). Also it missed a NULL check
at callsite and may lead to invalid memory access after that.

To fix this bug, just return 'encoder' when found, otherwise return
NULL. And add the NULL check.

Cc: stable@vger.kernel.org
Fixes: 1f7f3d91 ("drm/nouveau/clk: Respect voltage limits in nvkm_cstate_prog")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220327075824.11806-1-xiam0nd.tong@gmail.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 19323b36

drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -135,10 +135,10 @@ nvkm_cstate_find_best(struct nvkm_clk clk, struct nvkm_pstate pstate,

		list_for_each_entry_from_reverse(cstate, &pstate->list, head) {
		if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp))
		break;
		return cstate;
		}

		return cstate;
		return NULL;
		}

		static struct nvkm_cstate *
		@@ -169,6 +169,8 @@ nvkm_cstate_prog(struct nvkm_clk clk, struct nvkm_pstate pstate, int cstatei)
		if (!list_empty(&pstate->list)) {
		cstate = nvkm_cstate_get(clk, pstate, cstatei);
		cstate = nvkm_cstate_find_best(clk, pstate, cstate);
		if (!cstate)
		return -EINVAL;
		} else {
		cstate = &pstate->base;
		}