When a driver's fbdev probe callback fails before assigning
fb_helper->funcs (e.g. i915's intel_fbdev_driver_fbdev_probe() bailing
out early on a DMA/GGTT pin failure), the fbdev client stays registered
with fb_helper->funcs == NULL. Any later restore, such as on drm fd close
via drm_client_dev_restore() -> drm_fbdev_client_restore(), reaches
__drm_fb_helper_restore_fbdev_mode_unlocked() and unconditionally
dereferences fb_helper->funcs->fb_restore, causing a NULL pointer
dereference.
Guard the fb_restore call with a NULL check on fb_helper->funcs.
Fixes: 2ef5754c9649 ("drm/i915/display: fbdev: Move custom restore code to new
callback")
Signed-off-by: Sebastian Brzezinka <[email protected]>
---
drivers/gpu/drm/drm_fb_helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 7b11a582f8ec..77ae9bd5ef3d 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -146,7 +146,7 @@ __drm_fb_helper_restore_fbdev_mode_unlocked(struct
drm_fb_helper *fb_helper,
if (do_delayed)
drm_fb_helper_hotplug_event(fb_helper);
- if (fb_helper->funcs->fb_restore)
+ if (fb_helper->funcs && fb_helper->funcs->fb_restore)
fb_helper->funcs->fb_restore(fb_helper);
return ret;
--
2.53.0
