drm/amdgpu: avoid using null object of framebuffer

Instead of using state->fb->obj[0] directly, get object from framebuffer
by calling drm_gem_fb_get_obj() and return error code when object is
null to avoid using null object of framebuffer.

Reported-by: Fusheng Huang <fusheng.huang@ecarxgroup.com>
Signed-off-by: Julia Zhang <Julia.Zhang@amd.com>
Reviewed-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
index e30eecd02ae1c11e40c8bdbc394263020649b85f..fde66225c481a36463528c4f9f1d03120fa48e8c 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c
@@ -3,6 +3,7 @@
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_edid.h>
 #include <drm/drm_simple_kms_helper.h>
+#include <drm/drm_gem_framebuffer_helper.h>
 #include <drm/drm_vblank.h>
 
 #include "amdgpu.h"
@@ -314,7 +315,13 @@ static int amdgpu_vkms_prepare_fb(struct drm_plane *plane,
                return 0;
        }
        afb = to_amdgpu_framebuffer(new_state->fb);
-       obj = new_state->fb->obj[0];
+
+       obj = drm_gem_fb_get_obj(new_state->fb, 0);
+       if (!obj) {
+               DRM_ERROR("Failed to get obj from framebuffer\n");
+               return -EINVAL;
+       }
+
        rbo = gem_to_amdgpu_bo(obj);
        adev = amdgpu_ttm_adev(rbo->tbo.bdev);
 
@@ -368,12 +375,19 @@ static void amdgpu_vkms_cleanup_fb(struct drm_plane *plane,
                                   struct drm_plane_state *old_state)
 {
        struct amdgpu_bo *rbo;
+       struct drm_gem_object *obj;
        int r;
 
        if (!old_state->fb)
                return;
 
-       rbo = gem_to_amdgpu_bo(old_state->fb->obj[0]);
+       obj = drm_gem_fb_get_obj(old_state->fb, 0);
+       if (!obj) {
+               DRM_ERROR("Failed to get obj from framebuffer\n");
+               return;
+       }
+
+       rbo = gem_to_amdgpu_bo(obj);
        r = amdgpu_bo_reserve(rbo, false);
        if (unlikely(r)) {
                DRM_ERROR("failed to reserve rbo before unpin\n");