Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 526810ad authored by Roy Spliet's avatar Roy Spliet Committed by Ben Skeggs
Browse files

drm/nv50/fb: Fix nullptr-deref on IGPs 



When COMP_MAX_TAG == 0, the tags mm was uninitialised. Fixed by initialising with zero length.

v2: Fix style error

Signed-off-by: default avatarRoy Spliet <r.spliet@student.tudelft.nl>
Tested-by: default avatarRoy Spliet <r.spliet@student.tudelft.nl>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 1e98380c

drivers/gpu/drm/nouveau/core/subdev/fb/base.c

+2 −2
Original line number Diff line number Diff line
@@ -86,8 +86,8 @@ nouveau_fb_preinit(struct nouveau_fb *pfb) 
			return ret;

	}



	if (!nouveau_mm_initialised(&pfb->tags) && tags) {

		ret = nouveau_mm_init(&pfb->tags, 0, ++tags, 1);

	if (!nouveau_mm_initialised(&pfb->tags)) {

		ret = nouveau_mm_init(&pfb->tags, 0, tags ? ++tags : 0, 1);

		if (ret)

			return ret;

	}

drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c

+3 −2
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ nv50_fb_vram_init(struct nouveau_fb *pfb) 
	struct nouveau_bios *bios = nouveau_bios(device);

	const u32 rsvd_head = ( 256 * 1024) >> 12; /* vga memory */

	const u32 rsvd_tail = (1024 * 1024) >> 12; /* vbios etc */

	u32 size;

	u32 size, tags = 0;

	int ret;



	pfb->ram.size = nv_rd32(pfb, 0x10020c);
@@ -140,10 +140,11 @@ nv50_fb_vram_init(struct nouveau_fb *pfb) 
			return ret;



		pfb->ram.ranks = (nv_rd32(pfb, 0x100200) & 0x4) ? 2 : 1;

		tags = nv_rd32(pfb, 0x100320);

		break;

	}



	return nv_rd32(pfb, 0x100320);

	return tags;

}



static int