[PATCH] drm/nouveau: Fix NULL ptr access in nv50_wndw_prepare_fb()

James Jones jajones at nvidia.com
Mon Feb 10 23:09:43 UTC 2020


This fixes a kernel oops when loading the nouveau
module with fb console enabled after the change:

  drm/nouveau: Remove field nvbo from struct nouveau_framebuffer

state->fb may be NULL in nv50_wndw_prepare_fb(),
so defer initializing nvbo from its obj[] array
until after the NULL check.

Signed-off-by: James Jones <jajones at nvidia.com>
---
 drivers/gpu/drm/nouveau/dispnv50/wndw.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/dispnv50/wndw.c b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
index 4a67a656e007..68c0dc2dc2d3 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
@@ -490,7 +490,7 @@ nv50_wndw_prepare_fb(struct drm_plane *plane, struct drm_plane_state *state)
 	struct nouveau_drm *drm = nouveau_drm(plane->dev);
 	struct nv50_wndw *wndw = nv50_wndw(plane);
 	struct nv50_wndw_atom *asyw = nv50_wndw_atom(state);
-	struct nouveau_bo *nvbo = nouveau_gem_object(fb->obj[0]);
+	struct nouveau_bo *nvbo;
 	struct nv50_head_atom *asyh;
 	struct nv50_wndw_ctxdma *ctxdma;
 	int ret;
@@ -499,6 +499,7 @@ nv50_wndw_prepare_fb(struct drm_plane *plane, struct drm_plane_state *state)
 	if (!asyw->state.fb)
 		return 0;
 
+	nvbo = nouveau_gem_object(fb->obj[0]);
 	ret = nouveau_bo_pin(nvbo, TTM_PL_FLAG_VRAM, true);
 	if (ret)
 		return ret;
-- 
2.17.1



More information about the dri-devel mailing list