[Nouveau] [PATCH] drm/nv50/fb: Fix nullptr-deref on IGPs

[Roy Spliet]

When COMP_MAX_TAG == 0, the tags mm was uninitialised. Fixed by initialising with zero length.

Signed-off-by: Roy Spliet <r.spliet at student.tudelft.nl>
Tested-by: Roy Spliet <r.spliet at student.tudelft.nl>
---
 drivers/gpu/drm/nouveau/core/subdev/fb/base.c | 11 ++++++++---
 drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c |  5 +++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/base.c b/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
index d6d1600..695dde8 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
@@ -86,10 +86,15 @@ nouveau_fb_preinit(struct nouveau_fb *pfb)
 			return ret;
 	}
 
-	if (!nouveau_mm_initialised(&pfb->tags) && tags) {
-		ret = nouveau_mm_init(&pfb->tags, 0, ++tags, 1);
+	if (!nouveau_mm_initialised(&pfb->tags)) {
+		if(tags) {
+			ret = nouveau_mm_init(&pfb->tags, 0, ++tags, 1);
+		} else {
+			ret = nouveau_mm_init(&pfb->tags, 0, 0, 1);
+		}
+
 		if (ret)
-			return ret;
+					return ret;
 	}
 
 	nv_info(pfb, "RAM type: %s\n", name[pfb->ram.type]);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index a4338d9..0772ec9 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -101,7 +101,7 @@ nv50_fb_vram_init(struct nouveau_fb *pfb)
 	struct nouveau_bios *bios = nouveau_bios(device);
 	const u32 rsvd_head = ( 256 * 1024) >> 12; /* vga memory */
 	const u32 rsvd_tail = (1024 * 1024) >> 12; /* vbios etc */
-	u32 size;
+	u32 size, tags = 0;
 	int ret;
 
 	pfb->ram.size = nv_rd32(pfb, 0x10020c);
@@ -142,10 +142,11 @@ nv50_fb_vram_init(struct nouveau_fb *pfb)
 			return ret;
 
 		pfb->ram.ranks = (nv_rd32(pfb, 0x100200) & 0x4) ? 2 : 1;
+		tags = nv_rd32(pfb, 0x100320);
 		break;
 	}
 
-	return nv_rd32(pfb, 0x100320);
+	return tags;
 }
 
 static int
-- 
1.8.0.1