]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
drm/i915/dsi: Fix NULL pointer deref in vlv_dphy_param_init()
authorHans de Goede <hansg@kernel.org>
Thu, 26 Jun 2025 14:33:17 +0000 (16:33 +0200)
committerJoonas Lahtinen <joonas.lahtinen@linux.intel.com>
Mon, 30 Jun 2025 05:12:36 +0000 (08:12 +0300)
Commit 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct
intel_display") added a to_intel_display(connector) call to
vlv_dphy_param_init() but when vlv_dphy_param_init() gets called
the connector object has not been initialized yet, so this leads
to a NULL pointer deref:

 BUG: kernel NULL pointer dereference, address: 000000000000000c
 ...
 Hardware name: ASUSTeK COMPUTER INC. T100TA/T100TA, BIOS T100TA.314 08/13/2015
 RIP: 0010:vlv_dsi_init+0x4e6/0x1600 [i915]
 ...
 Call Trace:
  <TASK>
  ? intel_step_name+0x4be8/0x5c30 [i915]
  intel_setup_outputs+0x2d6/0xbd0 [i915]
  intel_display_driver_probe_nogem+0x13f/0x220 [i915]
  i915_driver_probe+0x3d9/0xaf0 [i915]

Use to_intel_display(&intel_dsi->base) instead to fix this.

Fixes: 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct intel_display")
Signed-off-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://lore.kernel.org/r/20250626143317.101706-1-hansg@kernel.org
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
(cherry picked from commit 0dc6bfb50a5d0759e726cd36a3d3b7529fd2a627)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
drivers/gpu/drm/i915/display/vlv_dsi.c

index 21c1e10caf684637b36fbe84752e8216bcaca406..2007bb9d974d347ca85d01bf3fb9d275f430ec5e 100644 (file)
@@ -1589,8 +1589,8 @@ static void vlv_dsi_add_properties(struct intel_connector *connector)
 
 static void vlv_dphy_param_init(struct intel_dsi *intel_dsi)
 {
+       struct intel_display *display = to_intel_display(&intel_dsi->base);
        struct intel_connector *connector = intel_dsi->attached_connector;
-       struct intel_display *display = to_intel_display(connector);
        struct mipi_config *mipi_config = connector->panel.vbt.dsi.config;
        u32 tlpx_ns, extra_byte_count, tlpx_ui;
        u32 ui_num, ui_den;