drm/nouveau/mxm: fix null deref on load

Since commit 61b365a505d6 ("drm/nouveau: populate master subdev pointer
only when fully constructed"), the nouveau_mxm(bios) call will return
NULL, since it's still being called from the constructor.  Instead, pass
the mxm pointer via the unused data field.

See https://bugs.freedesktop.org/show_bug.cgi?id=73791

Reported-by: Andreas Reis <[email protected]>
Tested-by: Andreas Reis <[email protected]>
Signed-off-by: Ilia Mirkin <[email protected]>
Cc: Ben Skeggs <[email protected]>
Cc: Dave Airlie <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
index af129c2e811388adbb3129a0f76f9648eb669658..64f8b4702bf7272c3edf7950e16bf46b07d5457a 100644 (file)
--- a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
@@ -100,7 +100,7 @@ mxm_match_dcb(struct nouveau_mxm *mxm, u8 *data, void *info)
 static int
 mxm_dcb_sanitise_entry(struct nouveau_bios *bios, void *data, int idx, u16 pdcb)
 {
-       struct nouveau_mxm *mxm = nouveau_mxm(bios);
+       struct nouveau_mxm *mxm = data;
        struct context ctx = { .outp = (u32 *)(bios->data + pdcb) };
        u8 type, i2cidx, link, ver, len;
        u8 *conn;
@@ -199,7 +199,7 @@ mxm_dcb_sanitise(struct nouveau_mxm *mxm)
                return;
        }
 
-       dcb_outp_foreach(bios, NULL, mxm_dcb_sanitise_entry);
+       dcb_outp_foreach(bios, mxm, mxm_dcb_sanitise_entry);
        mxms_foreach(mxm, 0x01, mxm_show_unmatched, NULL);
 }