i915: temporary fix for DP MST docking station NULL pointer dereference
authorLinus Torvalds <torvalds@linux-foundation.org>
Thu, 30 Jul 2015 05:18:16 +0000 (22:18 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sun, 2 Aug 2015 18:02:16 +0000 (11:02 -0700)
Ted Ts'o reports that his Lenovo T540p ThinkPad crashes at boot if
attached to the docking station.  This is a regression that he was able
to bisect to commit 8c7b5ccb7298: "drm/i915: Use atomic helpers for
computing changed flags:"

The reason seems to be the new call to drm_atomic_helper_check_modeset()
added to intel_modeset_compute_config(), which in turn calls
update_connector_routing(), and somehow ends up picking a NULL crtc for
the connector state, causing the subsequent drm_crtc_index() to OOPS.

Daniel Vetter says that the fundamental issue seems to be confusion in
the encoder selection, and this isn't the right fix, but while he chases
down the proper fix, this at least avoids the NULL pointer dereference
and makes Ted's docking station work again.

Reported-bisected-and-tested-by: Theodore Ts'o <tytso@mit.edu>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Mani Nikula <jani.nikula@linux.intel.com>
Cc: Dave Airlie <airlied@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/gpu/drm/drm_atomic_helper.c

index 5b59d5ad7d1c23fc41c6d657f19367b81d1ae1de..aac212297b49fb1953dab1749f23dcd77977bcb7 100644 (file)
@@ -230,10 +230,12 @@ update_connector_routing(struct drm_atomic_state *state, int conn_idx)
        }
 
        connector_state->best_encoder = new_encoder;
-       idx = drm_crtc_index(connector_state->crtc);
+       if (connector_state->crtc) {
+               idx = drm_crtc_index(connector_state->crtc);
 
-       crtc_state = state->crtc_states[idx];
-       crtc_state->mode_changed = true;
+               crtc_state = state->crtc_states[idx];
+               crtc_state->mode_changed = true;
+       }
 
        DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d]\n",
                         connector->base.id,