drm/bridge: Fix a NULL pointer dereference in drm_atomic_bridge_chain_check()

drm_atomic_bridge_chain_check() callers can pass a NULL bridge. Let's
bail out before dereferencing the bridge pointer when that happens.

Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
Fixes: b86d895524ab ("drm/bridge: Add an ->atomic_check() hook")
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20200107113031.435604-1-boris.brezillon@collabora.com

diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
index 3740060..32d43bf 100644 (file)
--- a/drivers/gpu/drm/drm_bridge.c
+++ b/drivers/gpu/drm/drm_bridge.c
@@ -938,15 +938,19 @@ int drm_atomic_bridge_chain_check(struct drm_bridge *bridge,
                                  struct drm_connector_state *conn_state)
 {
        struct drm_connector *conn = conn_state->connector;
-       struct drm_encoder *encoder = bridge->encoder;
+       struct drm_encoder *encoder;
        struct drm_bridge *iter;
        int ret;
 
+       if (!bridge)
+               return 0;
+
        ret = drm_atomic_bridge_chain_select_bus_fmts(bridge, crtc_state,
                                                      conn_state);
        if (ret)
                return ret;
 
+       encoder = bridge->encoder;
        list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) {
                int ret;