[Nouveau] [PATCH 1/2] drm/nouveau/fbcon: Fix NULL pointer access in nouveau_fbcon_destroy.

Jeffery Miller jmiller at neverware.com
Thu Jul 5 19:09:59 UTC 2018


It is possible for this to get called with a null helper.fb. This can
cause a bad pointer access when unloading the nouveau module on an
Optimus system.

Signed-off-by: Jeffery Miller <jmiller at neverware.com>
---
 drivers/gpu/drm/nouveau/nouveau_fbcon.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 85c1f10bc2b6..99b2e5bb2bce 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -420,7 +420,10 @@ nouveau_fbcon_create(struct drm_fb_helper *helper,
 static int
 nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *fbcon)
 {
-	struct nouveau_framebuffer *nouveau_fb = nouveau_framebuffer(fbcon->helper.fb);
+	struct nouveau_framebuffer *nouveau_fb = NULL;
+
+	if (fbcon->helper.fb)
+		nouveau_fb = nouveau_framebuffer(fbcon->helper.fb);
 
 	drm_fb_helper_unregister_fbi(&fbcon->helper);
 	drm_fb_helper_fini(&fbcon->helper);
-- 
2.17.1



More information about the Nouveau mailing list