[Nouveau] [PATCH 1/6] kms/nv50: move nv50_mstm out of the dp union in nouveau_encoder

Karol Herbst
2018-07-20T15:17:24Z

This field isn't only used for DP ones, but for all. Prevents memory
corruption when adding more structs to the union.

Signed-off-by: Karol Herbst <kherbst at redhat.com>
---
 drm/nouveau/dispnv50/disp.c     | 12 ++++++------
 drm/nouveau/nouveau_connector.c |  4 ++--
 drm/nouveau/nouveau_dp.c        |  2 +-
 drm/nouveau/nouveau_encoder.h   |  2 +-
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/drm/nouveau/dispnv50/disp.c b/drm/nouveau/dispnv50/disp.c
index 42f47ac9..f04ab219 100644
--- a/drm/nouveau/dispnv50/disp.c
+++ b/drm/nouveau/dispnv50/disp.c
@@ -1398,7 +1398,7 @@ static void
 nv50_sor_destroy(struct drm_encoder *encoder)
 {
 	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
-	nv50_mstm_del(&nv_encoder->dp.mstm);
+	nv50_mstm_del(&nv_encoder->mstm);
 	drm_encoder_cleanup(encoder);
 	kfree(encoder);
 }
@@ -1466,7 +1466,7 @@ nv50_sor_create(struct drm_connector *connector, struct
dcb_output *dcbe)
 		    ver >= 0x40 && (nvbios_rd08(bios, data + 0x08) & 0x04)) {
 			ret = nv50_mstm_new(nv_encoder, &nv_connector->aux, 16,
 					    nv_connector->base.base.id,
-					    &nv_encoder->dp.mstm);
+					    &nv_encoder->mstm);
 			if (ret)
 				return ret;
 		}
@@ -1622,7 +1622,7 @@ nv50_disp_atomic_commit_core(struct drm_atomic_state
*state, u32 *interlock)

 	drm_for_each_encoder(encoder, drm->dev) {
 		if (encoder->encoder_type != DRM_MODE_ENCODER_DPMST) {
-			mstm = nouveau_encoder(encoder)->dp.mstm;
+			mstm = nouveau_encoder(encoder)->mstm;
 			if (mstm && mstm->modified)
 				nv50_mstm_prepare(mstm);
 		}
@@ -1636,7 +1636,7 @@ nv50_disp_atomic_commit_core(struct drm_atomic_state
*state, u32 *interlock)

 	drm_for_each_encoder(encoder, drm->dev) {
 		if (encoder->encoder_type != DRM_MODE_ENCODER_DPMST) {
-			mstm = nouveau_encoder(encoder)->dp.mstm;
+			mstm = nouveau_encoder(encoder)->mstm;
 			if (mstm && mstm->modified)
 				nv50_mstm_cleanup(mstm);
 		}
@@ -2103,7 +2103,7 @@ nv50_display_fini(struct drm_device *dev)
 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
 		if (encoder->encoder_type != DRM_MODE_ENCODER_DPMST) {
 			nv_encoder = nouveau_encoder(encoder);
-			nv50_mstm_fini(nv_encoder->dp.mstm);
+			nv50_mstm_fini(nv_encoder->mstm);
 		}
 	}
 }
@@ -2121,7 +2121,7 @@ nv50_display_init(struct drm_device *dev)
 		if (encoder->encoder_type != DRM_MODE_ENCODER_DPMST) {
 			struct nouveau_encoder *nv_encoder  				nouveau_encoder(encoder);
-			nv50_mstm_init(nv_encoder->dp.mstm);
+			nv50_mstm_init(nv_encoder->mstm);
 		}
 	}

diff --git a/drm/nouveau/nouveau_connector.c b/drm/nouveau/nouveau_connector.c
index af68eae4..5cc94944 100644
--- a/drm/nouveau/nouveau_connector.c
+++ b/drm/nouveau/nouveau_connector.c
@@ -1124,14 +1124,14 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
 	if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
 		NV_DEBUG(drm, "service %s\n", name);
 		if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP)))
-			nv50_mstm_service(nv_encoder->dp.mstm);
+			nv50_mstm_service(nv_encoder->mstm);
 	} else {
 		bool plugged = (rep->mask != NVIF_NOTIFY_CONN_V0_UNPLUG);

 		NV_DEBUG(drm, "%splugged %s\n", plugged ? "" :
"un", name);
 		if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) {
 			if (!plugged)
-				nv50_mstm_remove(nv_encoder->dp.mstm);
+				nv50_mstm_remove(nv_encoder->mstm);
 		}

 		drm_helper_hpd_irq_event(connector->dev);
diff --git a/drm/nouveau/nouveau_dp.c b/drm/nouveau/nouveau_dp.c
index 0d052e16..7f71dff0 100644
--- a/drm/nouveau/nouveau_dp.c
+++ b/drm/nouveau/nouveau_dp.c
@@ -92,7 +92,7 @@ nouveau_dp_detect(struct nouveau_encoder *nv_encoder)

 	nouveau_dp_probe_oui(dev, aux, dpcd);

-	ret = nv50_mstm_detect(nv_encoder->dp.mstm, dpcd, nouveau_mst);
+	ret = nv50_mstm_detect(nv_encoder->mstm, dpcd, nouveau_mst);
 	if (ret == 1)
 		return NOUVEAU_DP_MST;
 	if (ret == 0)
diff --git a/drm/nouveau/nouveau_encoder.h b/drm/nouveau/nouveau_encoder.h
index 3517f920..dfe095ad 100644
--- a/drm/nouveau/nouveau_encoder.h
+++ b/drm/nouveau/nouveau_encoder.h
@@ -58,9 +58,9 @@ struct nouveau_encoder {

 	struct nv04_output_reg restore;

+	struct nv50_mstm *mstm;
 	union {
 		struct {
-			struct nv50_mstm *mstm;
 			int link_nr;
 			int link_bw;
 		} dp;
--
2.17.1