mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-13 14:14:37 +00:00
drm/nouveau/clk: Fix an incorrect NULL check on list iterator
commit1c3b2a27de
upstream. The bug is here: if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp)) return cstate; The list iterator value 'cstate' will *always* be set and non-NULL by list_for_each_entry_from_reverse(), so it is incorrect to assume that the iterator value will be unchanged if the list is empty or no element is found (In fact, it will be a bogus pointer to an invalid structure object containing the HEAD). Also it missed a NULL check at callsite and may lead to invalid memory access after that. To fix this bug, just return 'encoder' when found, otherwise return NULL. And add the NULL check. Cc: stable@vger.kernel.org Fixes:1f7f3d91ad
("drm/nouveau/clk: Respect voltage limits in nvkm_cstate_prog") Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220327075824.11806-1-xiam0nd.tong@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
461c0fdf94
commit
512027f8e2
1 changed files with 4 additions and 2 deletions
|
@ -135,10 +135,10 @@ nvkm_cstate_find_best(struct nvkm_clk *clk, struct nvkm_pstate *pstate,
|
|||
|
||||
list_for_each_entry_from_reverse(cstate, &pstate->list, head) {
|
||||
if (nvkm_cstate_valid(clk, cstate, max_volt, clk->temp))
|
||||
break;
|
||||
return cstate;
|
||||
}
|
||||
|
||||
return cstate;
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static struct nvkm_cstate *
|
||||
|
@ -169,6 +169,8 @@ nvkm_cstate_prog(struct nvkm_clk *clk, struct nvkm_pstate *pstate, int cstatei)
|
|||
if (!list_empty(&pstate->list)) {
|
||||
cstate = nvkm_cstate_get(clk, pstate, cstatei);
|
||||
cstate = nvkm_cstate_find_best(clk, pstate, cstate);
|
||||
if (!cstate)
|
||||
return -EINVAL;
|
||||
} else {
|
||||
cstate = &pstate->base;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue