[PATCH 1/2] drm/vc4: Fix NULL pointer dereference in the async update path

[Boris Brezillon]

vc4_plane_atomic_async_update() calls vc4_plane_atomic_check()
which in turn calls vc4_plane_setup_clipping_and_scaling(), and since
commit 58a6a36fe8e0 ("drm/vc4: Use
drm_atomic_helper_check_plane_state() to simplify the logic"), this
function accesses plane_state->state which will be NULL when called
from the async update path since we're passing previous plane state,
and plane_state->state has been assigned to NULL in
drm_atomic_helper_swap_state().

Assign plane->state->state to new_plane_state->state before calling
vc4_plane_atomic_check() and reset it to NULL after
vc4_plane_atomic_check() as returned.

Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic")
Signed-off-by: Boris Brezillon <boris.brezillon at bootlin.com>
---
 drivers/gpu/drm/vc4/vc4_plane.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 9dc3fcbd290b..c33c7dc2119d 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -827,8 +827,13 @@ static void vc4_plane_atomic_async_update(struct drm_plane *plane,
 	plane->state->src_x = state->src_x;
 	plane->state->src_y = state->src_y;
 
-	/* Update the display list based on the new crtc_x/y. */
+	/* Update the display list based on the new crtc_x/y.
+	 * The plane->state->state update dance is needed to avoid NULL pointer
+	 * dereference in vc4_plane_setup_clipping_and_scaling().
+	 */
+	plane->state->state = state->state;
 	vc4_plane_atomic_check(plane, plane->state);
+	plane->state->state = NULL;
 
 	/* Note that we can't just call vc4_plane_write_dlist()
 	 * because that would smash the context data that the HVS is
-- 
2.17.1