diff mbox

drm/nouveau/mxm: fix null deref on load

Message ID 1390145432-545-1-git-send-email-imirkin@alum.mit.edu (mailing list archive)
State New, archived
Headers show

Commit Message

Ilia Mirkin Jan. 19, 2014, 3:30 p.m. UTC
Since commit 61b365a50 (drm/nouveau: populate master subdev pointer only
when fully constructed), the nouveau_mxm(bios) call will return NULL,
since it's still being called from the constructor. Instead, pass the
mxm pointer via the unused data field.

See https://bugs.freedesktop.org/show_bug.cgi?id=73791

Reported-by: Andreas Reis <andreas.reis@gmail.com>
Tested-by: Andreas Reis <andreas.reis@gmail.com>
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
---

3.13 release time is approaching, so I'm expanding the To list, as this is a
crashing bug for potentially a lot of people (not sure how common the MXM
stuff is) and it'd be silly not to include the fix because someone along the
chain wasn't around. Hope I'm not stepping on any toes by sending to the full
upstream path...

 drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Linus Torvalds Jan. 20, 2014, 3:06 a.m. UTC | #1
Ok, I applied this, even though I hate the timing.

I also suspect that that whole commit 61b365a50 ("drm/nouveau:
populate master subdev pointer only when fully constructed") is just
completely buggered and the wrong thing to do. It also caused another
nasty change (fdd239ac99a0 "drm/nouveau: fix null ptr dereferences on
some boards") because it wasn't just the mxm data that was missing.

Whatever. It is what it is.

              Linus


On Sun, Jan 19, 2014 at 7:30 AM, Ilia Mirkin <imirkin@alum.mit.edu> wrote:
> Since commit 61b365a50 (drm/nouveau: populate master subdev pointer only
> when fully constructed), the nouveau_mxm(bios) call will return NULL,
> since it's still being called from the constructor. Instead, pass the
> mxm pointer via the unused data field.
>
> See https://bugs.freedesktop.org/show_bug.cgi?id=73791
>
> Reported-by: Andreas Reis <andreas.reis@gmail.com>
> Tested-by: Andreas Reis <andreas.reis@gmail.com>
> Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
> ---
>
> 3.13 release time is approaching, so I'm expanding the To list, as this is a
> crashing bug for potentially a lot of people (not sure how common the MXM
> stuff is) and it'd be silly not to include the fix because someone along the
> chain wasn't around. Hope I'm not stepping on any toes by sending to the full
> upstream path...
>
>  drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
> index af129c2..0bd3774 100644
> --- a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
> +++ b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
> @@ -100,7 +100,7 @@ mxm_match_dcb(struct nouveau_mxm *mxm, u8 *data, void *info)
>  static int
>  mxm_dcb_sanitise_entry(struct nouveau_bios *bios, void *data, int idx, u16 pdcb)
>  {
> -       struct nouveau_mxm *mxm = nouveau_mxm(bios);
> +       struct nouveau_mxm *mxm = data;
>         struct context ctx = { .outp = (u32 *)(bios->data + pdcb) };
>         u8 type, i2cidx, link, ver, len;
>         u8 *conn;
> @@ -199,7 +199,7 @@ mxm_dcb_sanitise(struct nouveau_mxm *mxm)
>                 return;
>         }
>
> -       dcb_outp_foreach(bios, NULL, mxm_dcb_sanitise_entry);
> +       dcb_outp_foreach(bios, mxm, mxm_dcb_sanitise_entry);
>         mxms_foreach(mxm, 0x01, mxm_show_unmatched, NULL);
>  }
>
> --
> 1.8.3.2
>
diff mbox

Patch

diff --git a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
index af129c2..0bd3774 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
@@ -100,7 +100,7 @@  mxm_match_dcb(struct nouveau_mxm *mxm, u8 *data, void *info)
 static int
 mxm_dcb_sanitise_entry(struct nouveau_bios *bios, void *data, int idx, u16 pdcb)
 {
-	struct nouveau_mxm *mxm = nouveau_mxm(bios);
+	struct nouveau_mxm *mxm = data;
 	struct context ctx = { .outp = (u32 *)(bios->data + pdcb) };
 	u8 type, i2cidx, link, ver, len;
 	u8 *conn;
@@ -199,7 +199,7 @@  mxm_dcb_sanitise(struct nouveau_mxm *mxm)
 		return;
 	}
 
-	dcb_outp_foreach(bios, NULL, mxm_dcb_sanitise_entry);
+	dcb_outp_foreach(bios, mxm, mxm_dcb_sanitise_entry);
 	mxms_foreach(mxm, 0x01, mxm_show_unmatched, NULL);
 }