[PATCH] drm: mxsfb: Fix crash when provided invalid DT bindings

[Marek Vasut]

On 01/31/2017 03:55 PM, Breno Matheus Lima wrote:
> 2017-01-28 15:01 GMT-02:00 Marek Vasut <marex at denx.de>:
>>
>> The mxsfb driver will crash if the mxsfb DT node has a subnode,
>> but the content of the subnode is not of-graph binding with an
>> endpoint linking to panel. The crash was triggered by providing
>> old-style panel bindings to the mxsfb driver instead of the new
>> of-graph ones.
>>
>> The problem happens in mxsfb_create_output(), which is invoked
>> from mxsfb_load(). The mxsfb_create_output() iterates over all
>> mxsfb DT subnode endpoints and tries to bind a panel on each
>> endpoint. If there is any problem binding the panel, that is,
>> mxsfb->panel == NULL, this function will return an error code,
>> otherwise success 0 is returned.
>>
>> If the subnodes do not specify of-graph binding with an endpoint,
>> the iteration over endpoints in mxsfb_create_output() will have
>> zero cycles and the function will immediatelly return 0, but the
>> mxsfb->panel will remain NULL. This is propagated back into the
>> mxsfb_load(), which does not detect any problem and expects that
>> the mxsfb->panel is valid, thus calls mxsfb_panel_attach(). But
>> since mxsfb->panel == NULL, mxsfb_panel_attach() is called with
>> first argument NULL and this crashes the kernel.
>>
>> This patch fixes the problem by explicitly checking for valid
>> mxsfb->panel at the end of the iteration in mxsfb_create_output().
>>
>> Signed-off-by: Marek Vasut <marex at denx.de>
>> Cc: Daniel Vetter <daniel.vetter at ffwll.ch>
>> Cc: Dave Airlie <airlied at redhat.com>
>> Cc: Stefan Agner <stefan at agner.ch>
>> Cc: Breno Matheus Lima <brenomatheus at gmail.com>
> 
> Tested-by: Breno Lima <breno.lima at nxp.com>
> 
Thanks, it'd be great if we could get this into 4.11 still.

-- 
Best regards,
Marek Vasut