Commit 0e83bb4e authored by Emil Velikov's avatar Emil Velikov Committed by Ben Skeggs
Browse files

drm/nv04/crtc: Bail out if FB is not bound to crtc 

This commit resolves a possible 'NULL pointer dereference'
It uses the same approach as radeon, intel and nouveau/nv50

Fixes bug 'Nouveau: Kernel oops when unplugging external monitor'
https://bugs.freedesktop.org/show_bug.cgi?id=40336



Signed-off-by: default avatarEmil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: default avatarBen Skeggs <bskeggs@redhat.com>
parent 1bf27066

drivers/gpu/drm/nouveau/nv04_crtc.c

+13 −2
Original line number Diff line number Diff line
@@ -781,11 +781,20 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc, 
	struct drm_device *dev = crtc->dev;

	struct drm_nouveau_private *dev_priv = dev->dev_private;

	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];

	struct drm_framebuffer *drm_fb = nv_crtc->base.fb;

	struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);

	struct drm_framebuffer *drm_fb;

	struct nouveau_framebuffer *fb;

	int arb_burst, arb_lwm;

	int ret;



	NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);



	/* no fb bound */

	if (!atomic && !crtc->fb) {

		NV_DEBUG_KMS(dev, "No FB bound\n");

		return 0;

	}





	/* If atomic, we want to switch to the fb we were passed, so

	 * now we update pointers to do that.  (We don't pin; just

	 * assume we're already pinned and update the base address.)
@@ -794,6 +803,8 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc, 
		drm_fb = passed_fb;

		fb = nouveau_framebuffer(passed_fb);

	} else {

		drm_fb = crtc->fb;

		fb = nouveau_framebuffer(crtc->fb);

		/* If not atomic, we can go ahead and pin, and unpin the

		 * old fb we were passed.

		 */

CRA Git | Maintained and supported by SUSTech CRA and CCSE