[22/37] drm: Reject fbs w/o format info in drm_framebuffer_init()
diff mbox

Message ID 1479498793-31021-23-git-send-email-ville.syrjala@linux.intel.com
State New
Headers show

Commit Message

Ville Syrjälä Nov. 18, 2016, 7:52 p.m. UTC
From: Ville Syrjälä <ville.syrjala@linux.intel.com>

Any framebuffer that doesn't have proper format information when
drm_framebuffer_init() is called is a bug. Let's warn and return
an error to avoid oopsing the kernel later due to dereferencing the
NULL fb->format pointer.

Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
---
 drivers/gpu/drm/drm_framebuffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Laurent Pinchart Nov. 19, 2016, 2:36 a.m. UTC | #1
Hi Ville,

Thank you for the patch.

On Friday 18 Nov 2016 21:52:58 ville.syrjala@linux.intel.com wrote:
> From: Ville Syrjälä <ville.syrjala@linux.intel.com>
> 
> Any framebuffer that doesn't have proper format information when
> drm_framebuffer_init() is called is a bug. Let's warn and return
> an error to avoid oopsing the kernel later due to dereferencing the
> NULL fb->format pointer.
> 
> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/gpu/drm/drm_framebuffer.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_framebuffer.c
> b/drivers/gpu/drm/drm_framebuffer.c index f397565d3c20..892976d974e5 100644
> --- a/drivers/gpu/drm/drm_framebuffer.c
> +++ b/drivers/gpu/drm/drm_framebuffer.c
> @@ -631,7 +631,7 @@ int drm_framebuffer_init(struct drm_device *dev, struct
> drm_framebuffer *fb, {
>  	int ret;
> 
> -	if (WARN_ON_ONCE(fb->dev != dev))
> +	if (WARN_ON_ONCE(fb->dev != dev || !fb->format))
>  		return -EINVAL;
> 
>  	INIT_LIST_HEAD(&fb->filp_head);

Patch
diff mbox

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index f397565d3c20..892976d974e5 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -631,7 +631,7 @@  int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 {
 	int ret;
 
-	if (WARN_ON_ONCE(fb->dev != dev))
+	if (WARN_ON_ONCE(fb->dev != dev || !fb->format))
 		return -EINVAL;
 
 	INIT_LIST_HEAD(&fb->filp_head);