Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

drm/amdgpu: avoid using null object of framebuffer

Instead of using state->fb->obj[0] directly, get object from framebuffer
by calling drm_gem_fb_get_obj() and return error code when object is
null to avoid using null object of framebuffer.

Reported-by: Fusheng Huang <fusheng.huang@ecarxgroup.com>
Signed-off-by: Julia Zhang <Julia.Zhang@amd.com>
Reviewed-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

authored by

Julia Zhang and committed by
Alex Deucher
bcfa48ff 2ec6c7f8

+16 -2
+16 -2
drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
··· 3 3 #include <drm/drm_atomic_helper.h> 4 4 #include <drm/drm_edid.h> 5 5 #include <drm/drm_simple_kms_helper.h> 6 + #include <drm/drm_gem_framebuffer_helper.h> 6 7 #include <drm/drm_vblank.h> 7 8 8 9 #include "amdgpu.h" ··· 315 314 return 0; 316 315 } 317 316 afb = to_amdgpu_framebuffer(new_state->fb); 318 - obj = new_state->fb->obj[0]; 317 + 318 + obj = drm_gem_fb_get_obj(new_state->fb, 0); 319 + if (!obj) { 320 + DRM_ERROR("Failed to get obj from framebuffer\n"); 321 + return -EINVAL; 322 + } 323 + 319 324 rbo = gem_to_amdgpu_bo(obj); 320 325 adev = amdgpu_ttm_adev(rbo->tbo.bdev); 321 326 ··· 375 368 struct drm_plane_state *old_state) 376 369 { 377 370 struct amdgpu_bo *rbo; 371 + struct drm_gem_object *obj; 378 372 int r; 379 373 380 374 if (!old_state->fb) 381 375 return; 382 376 383 - rbo = gem_to_amdgpu_bo(old_state->fb->obj[0]); 377 + obj = drm_gem_fb_get_obj(old_state->fb, 0); 378 + if (!obj) { 379 + DRM_ERROR("Failed to get obj from framebuffer\n"); 380 + return; 381 + } 382 + 383 + rbo = gem_to_amdgpu_bo(obj); 384 384 r = amdgpu_bo_reserve(rbo, false); 385 385 if (unlikely(r)) { 386 386 DRM_ERROR("failed to reserve rbo before unpin\n");