Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6bc26542 authored by Chris Wilson's avatar Chris Wilson
Browse files

drm/i915/fbdev: Check for the framebuffer before use 



If the fbdev probing fails, and in our error path we fail to clear the
dev_priv->fbdev, then we can try and use a dangling fbdev pointer, and
in particular a NULL fb. This could also happen in pathological cases
where we try to operate on the fbdev prior to it being probed.

Reported-by: default avatarMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Mika Kuoppala <mika.kuoppala@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1468431285-28264-2-git-send-email-chris@chris-wilson.co.uk


Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: default avatarMika Kuoppala <mika.kuoppala@intel.com>
parent 0b8c0e9c

drivers/gpu/drm/i915/intel_fbdev.c

+11 −14
Original line number Diff line number Diff line
@@ -782,7 +782,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous 
	struct intel_fbdev *ifbdev = dev_priv->fbdev;

	struct fb_info *info;



	if (!ifbdev)

	if (!ifbdev || !ifbdev->fb)

		return;



	info = ifbdev->helper.fbdev;
@@ -827,31 +827,28 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous 


void intel_fbdev_output_poll_changed(struct drm_device *dev)

{

	struct drm_i915_private *dev_priv = to_i915(dev);

	if (dev_priv->fbdev)

		drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);

	struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;



	if (ifbdev && ifbdev->fb)

		drm_fb_helper_hotplug_event(&ifbdev->helper);

}



void intel_fbdev_restore_mode(struct drm_device *dev)

{

	int ret;

	struct drm_i915_private *dev_priv = to_i915(dev);

	struct intel_fbdev *ifbdev = dev_priv->fbdev;

	struct drm_fb_helper *fb_helper;

	struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;



	if (!ifbdev)

		return;



	intel_fbdev_sync(ifbdev);

	if (!ifbdev->fb)

		return;



	fb_helper = &ifbdev->helper;



	ret = drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);

	if (ret) {

	if (drm_fb_helper_restore_fbdev_mode_unlocked(&ifbdev->helper)) {

		DRM_DEBUG("failed to restore crtc mode\n");

	} else {

		mutex_lock(&fb_helper->dev->struct_mutex);

		mutex_lock(&dev->struct_mutex);

		intel_fb_obj_invalidate(ifbdev->fb->obj, ORIGIN_GTT);

		mutex_unlock(&fb_helper->dev->struct_mutex);

		mutex_unlock(&dev->struct_mutex);

	}

}