aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/drm_bridge.c
diff options
context:
space:
mode:
authorBoris Brezillon <boris.brezillon@collabora.com>2020-01-07 12:30:31 +0100
committerBoris Brezillon <boris.brezillon@collabora.com>2020-01-07 14:19:54 +0100
commitb18398c16e176513502f962b642f89225039ef1f (patch)
tree2425c057a17c762c7491456e8aca9197196c8d13 /drivers/gpu/drm/drm_bridge.c
parentdrm/mgag200: Add module parameter to pin all buffers at offset 0 (diff)
downloadlinux-dev-b18398c16e176513502f962b642f89225039ef1f.tar.xz
linux-dev-b18398c16e176513502f962b642f89225039ef1f.zip
drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check()
drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's bail out before dereferencing the bridge pointer when that happens. Reported-by: Chris Wilson <chris@chris-wilson.co.uk> Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook") Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Link: https://patchwork.freedesktop.org/patch/msgid/20200107113031.435604-1-boris.brezillon@collabora.com
Diffstat (limited to 'drivers/gpu/drm/drm_bridge.c')
-rw-r--r--drivers/gpu/drm/drm_bridge.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
index 37400607e9b7..32d43bfeeca1 100644
--- a/drivers/gpu/drm/drm_bridge.c
+++ b/drivers/gpu/drm/drm_bridge.c
@@ -938,15 +938,19 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge,
struct drm_connector_state *conn_state)
{
struct drm_connector *conn = conn_state->connector;
- struct drm_encoder *encoder = bridge->encoder;
+ struct drm_encoder *encoder;
struct drm_bridge *iter;
int ret;
+ if (!bridge)
+ return 0;
+
ret = drm_atomic_bridge_chain_select_bus_fmts(bridge, crtc_state,
conn_state);
if (ret)
return ret;
+ encoder = bridge->encoder;
list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
int ret;