[PATCH v3 1/2] drm/vc4: Fix NULL pointer dereference in the async update path

[Boris Brezillon]

On Thu, 15 Nov 2018 08:25:48 -0800
Eric Anholt <eric at anholt.net> wrote:

> Boris Brezillon <boris.brezillon at bootlin.com> writes:
> 
> > vc4_plane_atomic_async_update() calls vc4_plane_atomic_check()
> > which in turn calls vc4_plane_setup_clipping_and_scaling(), and since
> > commit 58a6a36fe8e0 ("drm/vc4: Use
> > drm_atomic_helper_check_plane_state() to simplify the logic"), this
> > function accesses plane_state->state which will be NULL when called
> > from the async update path because we're passing the current plane
> > state, and plane_state->state has been assigned to NULL in
> > drm_atomic_helper_swap_state().
> >
> > Pass the new state instead of the current one (the new state has  
> > ->state set to a non-NULL value).  
> >
> > Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic")
> > Signed-off-by: Boris Brezillon <boris.brezillon at bootlin.com>  
> 
> I'm glad this worked!
> 
> Reviewed-by: Eric Anholt <eric at anholt.net>

Series applied to drm-misc-fixes.