OSDN Git Service

drm/dp_mst: Fix NULL deref in drm_dp_get_one_sb_msg()
authorLyude Paul <lyude@redhat.com>
Mon, 6 Apr 2020 19:33:52 +0000 (15:33 -0400)
committerLyude Paul <lyude@redhat.com>
Mon, 6 Apr 2020 19:54:00 +0000 (15:54 -0400)
commitcbfb1b74438fdab9ab34a24bb3a206033d807dc0
tree951c06f45208e615e1c889e4e17ee3cd233761fb
parented7cca1ff0142b4e24daed94271afef3b9bb4162
drm/dp_mst: Fix NULL deref in drm_dp_get_one_sb_msg()

While we don't need this function to store an mstb anywhere for UP
requests since we process them asynchronously, we do need to make sure
that we don't try to write to **mstb for UP requests otherwise we'll
cause a NULL pointer deref:

    RIP: 0010:drm_dp_get_one_sb_msg+0x4b/0x460 [drm_kms_helper]
    Call Trace:
     ? vprintk_emit+0x16a/0x230
     ? drm_dp_mst_hpd_irq+0x133/0x1010 [drm_kms_helper]
     drm_dp_mst_hpd_irq+0x133/0x1010 [drm_kms_helper]
     ? __drm_dbg+0x87/0x90 [drm]
     ? intel_dp_hpd_pulse+0x24b/0x400 [i915]
     intel_dp_hpd_pulse+0x24b/0x400 [i915]
     i915_digport_work_func+0xd6/0x160 [i915]
     process_one_work+0x1a9/0x370
     worker_thread+0x4d/0x3a0
     kthread+0xf9/0x130
     ? process_one_work+0x370/0x370
     ? kthread_park+0x90/0x90
     ret_from_fork+0x35/0x40

So, fix this.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Fixes: fbc821c4a506 ("drm/mst: Support simultaneous down replies")
Cc: Wayne Lin <Wayne.Lin@amd.com>
Cc: Lyude Paul <lyude@redhat.com>
Cc: Wayne Lin <waynelin@amd.com>
Cc: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200406193352.1245985-1-lyude@redhat.com
Reviewed-by: Sean Paul <sean@poorly.run>
drivers/gpu/drm/drm_dp_mst_topology.c