drm/i915: Fix oops caused by fbdev initialization failure
authorLukas Wunner <lukas@wunner.de>
Wed, 18 Nov 2015 12:43:20 +0000 (13:43 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 17 Mar 2016 01:25:23 +0000 (01:25 +0000)
commit879f2a9d3bfd761c77603e639ab431d75f034932
tree0d5dc21cf3537cb3f24fa6bf04aa8ec1dbe51493
parent2bf7542afdc0e4e479e733497656b2f5f1169ee2
drm/i915: Fix oops caused by fbdev initialization failure

intelfb_create() is called once on driver initialization. If it fails,
ifbdev->helper.fbdev, ifbdev->fb or ifbdev->fb->obj may be NULL.

Further up in the call stack, intel_fbdev_initial_config() calls
intel_fbdev_fini() to tear down the ifbdev on failure. This calls
intel_fbdev_destroy() which dereferences ifbdev->fb. Fix the ensuing
oops.

Also check in these functions if ifbdev is not NULL to avoid oops:

i915_gem_framebuffer_info() is called on access to debugfs file
"i915_gem_framebuffer" and dereferences ifbdev, ifbdev->helper.fb
and ifbdev->helper.fb->obj.

intel_connector_add_to_fbdev() / intel_connector_remove_from_fbdev()
are called when registering / unregistering an mst connector and
dereference ifbdev.

v3: Drop additional null pointer checks in intel_fbdev_set_suspend(),
    intel_fbdev_output_poll_changed() and intel_fbdev_restore_mode()
    since they already check if ifbdev is not NULL, which is sufficient
    now that intel_fbdev_fini() is called on initialization failure.
    (Requested by Daniel Vetter <daniel.vetter@ffwll.ch>)

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: http://patchwork.freedesktop.org/patch/msgid/d05f0edf121264a9d0adb8ca713fd8cc4ae068bf.1447938059.git.lukas@wunner.de
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Gbp-Pq: Topic bugfix/x86
Gbp-Pq: Name drm-i915-Fix-oops-caused-by-fbdev-initialization-fai.patch
drivers/gpu/drm/i915/i915_debugfs.c
drivers/gpu/drm/i915/intel_dp_mst.c
drivers/gpu/drm/i915/intel_fbdev.c