summaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/nouveau
diff options
context:
space:
mode:
authorEmil Velikov <emil.l.velikov@gmail.com>2011-08-21 22:48:12 +0100
committerBen Skeggs <bskeggs@redhat.com>2011-09-09 17:23:56 +1000
commitffbc559b0699891c6deb9fd2b4750671eab94999 (patch)
treeeeb1dce1e2a809138353fdba7f81ad2d210a47a1 /drivers/gpu/drm/nouveau
parentddf28352b80c86754a6424e3a61e8bdf9213b3c7 (diff)
downloadblackbird-op-linux-ffbc559b0699891c6deb9fd2b4750671eab94999.tar.gz
blackbird-op-linux-ffbc559b0699891c6deb9fd2b4750671eab94999.zip
drm/nv50/crtc: Bail out if FB is not bound to crtc
Fixes possbile NULL pointer dereference Resolves 'kernel crash in nv50_crtc_do_mode_set_base during shutdown' https://bugs.freedesktop.org/show_bug.cgi?id=40005 Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to 'drivers/gpu/drm/nouveau')
-rw-r--r--drivers/gpu/drm/nouveau/nv50_crtc.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
index 46ad59ea2185..5d989073ba6e 100644
--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -519,12 +519,18 @@ nv50_crtc_do_mode_set_base(struct drm_crtc *crtc,
struct drm_device *dev = nv_crtc->base.dev;
struct drm_nouveau_private *dev_priv = dev->dev_private;
struct nouveau_channel *evo = nv50_display(dev)->master;
- struct drm_framebuffer *drm_fb = nv_crtc->base.fb;
- struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+ struct drm_framebuffer *drm_fb;
+ struct nouveau_framebuffer *fb;
int ret;
NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+ /* no fb bound */
+ if (!atomic && !crtc->fb) {
+ NV_DEBUG_KMS(dev, "No FB bound\n");
+ return 0;
+ }
+
/* If atomic, we want to switch to the fb we were passed, so
* now we update pointers to do that. (We don't pin; just
* assume we're already pinned and update the base address.)
@@ -533,6 +539,8 @@ nv50_crtc_do_mode_set_base(struct drm_crtc *crtc,
drm_fb = passed_fb;
fb = nouveau_framebuffer(passed_fb);
} else {
+ drm_fb = crtc->fb;
+ fb = nouveau_framebuffer(crtc->fb);
/* If not atomic, we can go ahead and pin, and unpin the
* old fb we were passed.
*/
OpenPOWER on IntegriCloud