summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorIlia Mirkin <imirkin@alum.mit.edu>2014-01-19 16:30:32 +0100
committerLinus Torvalds <torvalds@linux-foundation.org>2014-01-20 03:28:30 +0100
commit72de182362e013b2c2cc92092d97fff58e429d5d (patch)
tree98be8fc5088c612948a57c2f307ae7f81b603a88
parentMerge tag 'acpi-3.13-fixup' of git://git.kernel.org/pub/scm/linux/kernel/git/... (diff)
downloadlinux-72de182362e013b2c2cc92092d97fff58e429d5d.tar.xz
linux-72de182362e013b2c2cc92092d97fff58e429d5d.zip
drm/nouveau/mxm: fix null deref on load
Since commit 61b365a505d6 ("drm/nouveau: populate master subdev pointer only when fully constructed"), the nouveau_mxm(bios) call will return NULL, since it's still being called from the constructor. Instead, pass the mxm pointer via the unused data field. See https://bugs.freedesktop.org/show_bug.cgi?id=73791 Reported-by: Andreas Reis <andreas.reis@gmail.com> Tested-by: Andreas Reis <andreas.reis@gmail.com> Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu> Cc: Ben Skeggs <bskeggs@redhat.com> Cc: Dave Airlie <airlied@linux.ie> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
index af129c2e8113..64f8b4702bf7 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
@@ -100,7 +100,7 @@ mxm_match_dcb(struct nouveau_mxm *mxm, u8 *data, void *info)
static int
mxm_dcb_sanitise_entry(struct nouveau_bios *bios, void *data, int idx, u16 pdcb)
{
- struct nouveau_mxm *mxm = nouveau_mxm(bios);
+ struct nouveau_mxm *mxm = data;
struct context ctx = { .outp = (u32 *)(bios->data + pdcb) };
u8 type, i2cidx, link, ver, len;
u8 *conn;
@@ -199,7 +199,7 @@ mxm_dcb_sanitise(struct nouveau_mxm *mxm)
return;
}
- dcb_outp_foreach(bios, NULL, mxm_dcb_sanitise_entry);
+ dcb_outp_foreach(bios, mxm, mxm_dcb_sanitise_entry);
mxms_foreach(mxm, 0x01, mxm_show_unmatched, NULL);
}