target/linux/bcm27xx/patches-4.19/950-0664-drm-vc4-Fix-NULL-pointer-dereference-in-the-async-up.patch

   1 From 0e81807e647c5e12fd897f3d520252ea60de3ff9 Mon Sep 17 00:00:00 2001
   2 From: Boris Brezillon <boris.brezillon@bootlin.com>
   3 Date: Thu, 15 Nov 2018 11:58:51 +0100
   4 Subject: [PATCH] drm/vc4: Fix NULL pointer dereference in the async
   5  update path
   6
   7 vc4_plane_atomic_async_update() calls vc4_plane_atomic_check()
   8 which in turn calls vc4_plane_setup_clipping_and_scaling(), and since
   9 commit 58a6a36fe8e0 ("drm/vc4: Use
  10 drm_atomic_helper_check_plane_state() to simplify the logic"), this
  11 function accesses plane_state->state which will be NULL when called
  12 from the async update path because we're passing the current plane
  13 state, and plane_state->state has been assigned to NULL in
  14 drm_atomic_helper_swap_state().
  15
  16 Pass the new state instead of the current one (the new state has
  17 ->state set to a non-NULL value).
  18
  19 Fixes: 58a6a36fe8e0 ("drm/vc4: Use drm_atomic_helper_check_plane_state() to simplify the logic")
  20 Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
  21 Reviewed-by: Eric Anholt <eric@anholt.net>
  22 Link: https://patchwork.freedesktop.org/patch/msgid/20181115105852.9844-1-boris.brezillon@bootlin.com
  23 ---
  24  drivers/gpu/drm/vc4/vc4_plane.c | 15 +++++++++++++--
  25  1 file changed, 13 insertions(+), 2 deletions(-)
  26
  27 --- a/drivers/gpu/drm/vc4/vc4_plane.c
  28 +++ b/drivers/gpu/drm/vc4/vc4_plane.c
  29 @@ -905,7 +905,7 @@ void vc4_plane_async_set_fb(struct drm_p
  30  static void vc4_plane_atomic_async_update(struct drm_plane *plane,
  31                                           struct drm_plane_state *state)
  32  {
  33 -       struct vc4_plane_state *vc4_state = to_vc4_plane_state(plane->state);
  34 +       struct vc4_plane_state *vc4_state, *new_vc4_state;
  35
  36         if (plane->state->fb != state->fb) {
  37                 vc4_plane_async_set_fb(plane, state->fb);
  38 @@ -927,7 +927,18 @@ static void vc4_plane_atomic_async_updat
  39         plane->state->src_y = state->src_y;
  40
  41         /* Update the display list based on the new crtc_x/y. */
  42 -       vc4_plane_atomic_check(plane, plane->state);
  43 +       vc4_plane_atomic_check(plane, state);
  44 +
  45 +       new_vc4_state = to_vc4_plane_state(state);
  46 +       vc4_state = to_vc4_plane_state(plane->state);
  47 +
  48 +       /* Update the current vc4_state pos0, pos2 and ptr0 dlist entries. */
  49 +       vc4_state->dlist[vc4_state->pos0_offset] =
  50 +               new_vc4_state->dlist[vc4_state->pos0_offset];
  51 +       vc4_state->dlist[vc4_state->pos2_offset] =
  52 +               new_vc4_state->dlist[vc4_state->pos2_offset];
  53 +       vc4_state->dlist[vc4_state->ptr0_offset] =
  54 +               new_vc4_state->dlist[vc4_state->ptr0_offset];
  55
  56         /* Note that we can't just call vc4_plane_write_dlist()
  57          * because that would smash the context data that the HVS is