[PATCH] drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check()

[PATCH] drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check()

[Boris Brezillon]

drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's
bail out before derefencing the bridge pointer when that happens.

Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
---
 drivers/gpu/drm/drm_bridge.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
index da28967bc586..f6f020854e83 100644
--- a/drivers/gpu/drm/drm_bridge.c
+++ b/drivers/gpu/drm/drm_bridge.c
@@ -941,15 +941,19 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge,
 				  struct drm_connector_state *conn_state)
 {
 	struct drm_connector *conn = conn_state->connector;
-	struct drm_encoder *encoder = bridge->encoder;
+	struct drm_encoder *encoder;
 	struct drm_bridge *iter;
 	int ret;
 
+	if (!bridge)
+		return 0;
+
 	ret = drm_atomic_bridge_chain_select_bus_fmts(bridge, crtc_state,
 						      conn_state);
 	if (ret)
 		return ret;
 
+	encoder = bridge->encoder;
 	list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
 		int ret;
 
-- 
2.23.0

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check()

[Laurent Pinchart]

Hi Boris,

Thank you for the patch.

On Tue, Jan 07, 2020 at 12:30:31PM +0100, Boris Brezillon wrote:
> drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's
> bail out before derefencing the bridge pointer when that happens.
> 
> Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
> Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook")
> Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/gpu/drm/drm_bridge.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
> index da28967bc586..f6f020854e83 100644
> --- a/drivers/gpu/drm/drm_bridge.c
> +++ b/drivers/gpu/drm/drm_bridge.c
> @@ -941,15 +941,19 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge,
>  				  struct drm_connector_state *conn_state)
>  {
>  	struct drm_connector *conn = conn_state->connector;
> -	struct drm_encoder *encoder = bridge->encoder;
> +	struct drm_encoder *encoder;
>  	struct drm_bridge *iter;
>  	int ret;
>  
> +	if (!bridge)
> +		return 0;
> +
>  	ret = drm_atomic_bridge_chain_select_bus_fmts(bridge, crtc_state,
>  						      conn_state);
>  	if (ret)
>  		return ret;
>  
> +	encoder = bridge->encoder;
>  	list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
>  		int ret;
>  

-- 
Regards,

Laurent Pinchart
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check()

[Chris Wilson]

Quoting Laurent Pinchart (2020-01-07 12:15:47)
> Hi Boris,
> 
> Thank you for the patch.
> 
> On Tue, Jan 07, 2020 at 12:30:31PM +0100, Boris Brezillon wrote:
> > drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's
> > bail out before derefencing the bridge pointer when that happens.
> > 
> > Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook")
> > Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
> 
> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

CI is back to its normal grumpy self,
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
-Chris
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel