[PATCH] drm/i915/dsi: Fix NULL pointer deref in vlv_dphy_param_init()

[Jani Nikula]

On Thu, 26 Jun 2025, Hans de Goede <hansg at kernel.org> wrote:
> Commit 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct
> intel_display") added a to_intel_display(connector) call to
> vlv_dphy_param_init() but when vlv_dphy_param_init() gets called
> the connector object has not been initialized yet, so this leads
> to a NULL pointer deref:
>
>  BUG: kernel NULL pointer dereference, address: 000000000000000c
>  ...
>  Hardware name: ASUSTeK COMPUTER INC. T100TA/T100TA, BIOS T100TA.314 08/13/2015
>  RIP: 0010:vlv_dsi_init+0x4e6/0x1600 [i915]
>  ...
>  Call Trace:
>   <TASK>
>   ? intel_step_name+0x4be8/0x5c30 [i915]
>   intel_setup_outputs+0x2d6/0xbd0 [i915]
>   intel_display_driver_probe_nogem+0x13f/0x220 [i915]
>   i915_driver_probe+0x3d9/0xaf0 [i915]
>
> Use to_intel_display(&intel_dsi->base) instead to fix this.

Oops, my bad. It's misleading that the DSI init handles uninitialized
connector so much, and the encoder has been initialized much
earlier. But I guess this is the simplest fix.

Reviewed-by: Jani Nikula <jani.nikula at intel.com>

>
> Fixes: 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct intel_display")
> Signed-off-by: Hans de Goede <hansg at kernel.org>
> ---
>  drivers/gpu/drm/i915/display/vlv_dsi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/display/vlv_dsi.c b/drivers/gpu/drm/i915/display/vlv_dsi.c
> index 21c1e10caf68..2007bb9d974d 100644
> --- a/drivers/gpu/drm/i915/display/vlv_dsi.c
> +++ b/drivers/gpu/drm/i915/display/vlv_dsi.c
> @@ -1589,8 +1589,8 @@ static void vlv_dsi_add_properties(struct intel_connector *connector)
>  
>  static void vlv_dphy_param_init(struct intel_dsi *intel_dsi)
>  {
> +	struct intel_display *display = to_intel_display(&intel_dsi->base);
>  	struct intel_connector *connector = intel_dsi->attached_connector;
> -	struct intel_display *display = to_intel_display(connector);
>  	struct mipi_config *mipi_config = connector->panel.vbt.dsi.config;
>  	u32 tlpx_ns, extra_byte_count, tlpx_ui;
>  	u32 ui_num, ui_den;

-- 
Jani Nikula, Intel