<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> <span class="fn">Chris Wilson</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [HSW] NULL pointer dereference in intel_fbdev_invalidate"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101534">bug 101534</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEEDINFO
</td>
<td>RESOLVED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>---
</td>
<td>FIXED
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [HSW] NULL pointer dereference in intel_fbdev_invalidate"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101534#c7">Comment # 7</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [HSW] NULL pointer dereference in intel_fbdev_invalidate"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101534">bug 101534</a>
from <span class="vcard"><a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> <span class="fn">Chris Wilson</span></a>
</span></b>
<pre>commit 15727ed0d944ce1dec8b9e1082dd3df29a0fdf44
Author: Chris Wilson <<a href="mailto:chris@chris-wilson.co.uk">chris@chris-wilson.co.uk</a>>
Date: Thu Jun 22 17:02:11 2017 +0100
drm/i915/fbdev: Check for existence of ifbdev->vma before operations
Commit fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer
flushes") adds a dependency to ifbdev->vma when flushing the framebufer,
but the checks are only against the existence of the ifbdev->fb and not
against ifbdev->vma. This leaves a window of opportunity where we may
try to operate on the fbdev prior to it being probed (thanks to
asynchronous booting).
Bugzilla: <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [HSW] NULL pointer dereference in intel_fbdev_invalidate"
href="show_bug.cgi?id=101534">https://bugs.freedesktop.org/show_bug.cgi?id=101534</a>
Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer
flushes")
Signed-off-by: Chris Wilson <<a href="mailto:chris@chris-wilson.co.uk">chris@chris-wilson.co.uk</a>>
Cc: Joonas Lahtinen <<a href="mailto:joonas.lahtinen@linux.intel.com">joonas.lahtinen@linux.intel.com</a>>
Cc: Daniel Vetter <<a href="mailto:daniel.vetter@intel.com">daniel.vetter@intel.com</a>>
Link:
<a href="http://patchwork.freedesktop.org/patch/msgid/20170622160211.783-1-chris@chris-wilson.co.uk">http://patchwork.freedesktop.org/patch/msgid/20170622160211.783-1-chris@chris-wilson.co.uk</a>
Reviewed-by: Tvrtko Ursulin <<a href="mailto:tvrtko.ursulin@intel.com">tvrtko.ursulin@intel.com</a>>
Cc: <a href="mailto:stable@vger.kernel.org">stable@vger.kernel.org</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>