[Intel-gfx] [PATCH] drm/i915/display: Check for an LPSP encoder before dereferencing

[Anshuman Gupta]

On 2020-07-29 at 14:09:12 +0100, Chris Wilson wrote:
> Avoid a GPF at
> 
> <1>[   20.177320] BUG: kernel NULL pointer dereference, address: 000000000000007c
> <1>[   20.177322] #PF: supervisor read access in kernel mode
> <1>[   20.177323] #PF: error_code(0x0000) - not-present page
> <6>[   20.177324] PGD 0 P4D 0
> <4>[   20.177327] Oops: 0000 [#1] PREEMPT SMP PTI
> <4>[   20.177328] CPU: 1 PID: 944 Comm: debugfs_test Not tainted 5.8.0-rc7-CI-CI_DRM_8814+ #1
> <4>[   20.177330] Hardware name: Dell Inc. XPS 13 9360/0823VW, BIOS 2.9.0 07/09/2018
> <4>[   20.177372] RIP: 0010:i915_lpsp_capability_show+0x44/0xc0 [i915]
> <4>[   20.177374] Code: 0f b6 81 ca 0d 00 00 3c 0b 74 77 76 19 3c 0c 75 44 83 7e 7c 01 7e 2f 48 c7 c6 d7 b9 47 a0 e8 43 df 06 e1 31 c0 c3 3c 09 72 2b <8b> 46 7c 85 c0 75 e6 8b 82 e4 00 00 00 89 c2 83 e2 fb 83 fa 0a 74
> <4>[   20.177376] RSP: 0018:ffffc90000cebe38 EFLAGS: 00010246
> <4>[   20.177377] RAX: 0000000000000009 RBX: ffff888267fe6a58 RCX: ffff888252d10000
> <4>[   20.177378] RDX: ffff88824a9a4000 RSI: 0000000000000000 RDI: ffff888267fe6a30
> <4>[   20.177379] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
> <4>[   20.177380] R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90000cebf08
> <4>[   20.177381] R13: 00000000ffffffff R14: 0000000000000001 R15: ffff888267fe6a30
> <4>[   20.177383] FS:  00007f6f9c6b5e40(0000) GS:ffff888276480000(0000) knlGS:0000000000000000
> <4>[   20.177384] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> <4>[   20.177385] CR2: 000000000000007c CR3: 0000000255f04006 CR4: 00000000003606e0
> <4>[   20.177386] Call Trace:
> <4>[   20.177390]  seq_read+0xcb/0x420
> 
> which is presumably from having no encoder attached at that time.
> 
> Fixes: 8806211fe7b3 ("drm/i915: Add i915_lpsp_capability debugfs")
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> Cc: Animesh Manna <animesh.manna at intel.com>
> Cc: Anshuman Gupta <anshuman.gupta at intel.com>
> Cc: Uma Shankar <uma.shankar at intel.com>
> Cc: "Ville Syrjälä" <ville.syrjala at linux.intel.com>
Reviewed-by: Anshuman Gupta <anshuman.gupta at intel.com>
> ---
>  drivers/gpu/drm/i915/display/intel_display_debugfs.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/display/intel_display_debugfs.c b/drivers/gpu/drm/i915/display/intel_display_debugfs.c
> index 3644752cc5ec..5a5cfe25085b 100644
> --- a/drivers/gpu/drm/i915/display/intel_display_debugfs.c
> +++ b/drivers/gpu/drm/i915/display/intel_display_debugfs.c
> @@ -2044,9 +2044,12 @@ DEFINE_SHOW_ATTRIBUTE(i915_hdcp_sink_capability);
>  static int i915_lpsp_capability_show(struct seq_file *m, void *data)
>  {
>  	struct drm_connector *connector = m->private;
> -	struct intel_encoder *encoder =
> -			intel_attached_encoder(to_intel_connector(connector));
>  	struct drm_i915_private *i915 = to_i915(connector->dev);
> +	struct intel_encoder *encoder;
> +
> +	encoder = intel_attached_encoder(to_intel_connector(connector));
> +	if (!encoder)
> +		return -ENODEV;
>  
>  	if (connector->status != connector_status_connected)
>  		return -ENODEV;
> -- 
> 2.20.1
>