Commit 05865769 authored May 15, 2019 by Noralf Trønnes

drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument

drm_fb_helper_hotplug_event() should tolerate the fb_helper argument being
NULL. Commit 03a9606e ("drm/fb-helper: Avoid race with DRM userspace")
introduced a fb_helper dereference before the NULL check.
Fixup by moving the dereference after the NULL check.

Fixes: 03a9606e ("drm/fb-helper: Avoid race with DRM userspace")
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20190515132925.48867-1-noralf@tronnes.org

parent 86d804f4

drivers/gpu/drm/drm_fb_helper.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -3031,7 +3031,6 @@ EXPORT_SYMBOL(drm_fb_helper_initial_config);
		*/
		int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
		{
		struct drm_device *dev = fb_helper->dev;
		int err = 0;

		if (!drm_fbdev_emulation \|\| !fb_helper)
		@@ -3044,13 +3043,13 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
		return err;
		}

		if (!fb_helper->fb \|\| !drm_master_internal_acquire(dev)) {
		if (!fb_helper->fb \|\| !drm_master_internal_acquire(fb_helper->dev)) {
		fb_helper->delayed_hotplug = true;
		mutex_unlock(&fb_helper->lock);
		return err;
		}

		drm_master_internal_release(dev);
		drm_master_internal_release(fb_helper->dev);

		DRM_DEBUG_KMS("\n");