drm/nv04/crtc: Bail out if FB is not bound to crtc

This commit resolves a possible 'NULL pointer dereference'
It uses the same approach as radeon, intel and nouveau/nv50

Fixes bug 'Nouveau: Kernel oops when unplugging external monitor'
https://bugs.freedesktop.org/show_bug.cgi?id=40336

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

1 files changed, 13 insertions, 2 deletions

diff --git a/drivers/gpu/drm/nouveau/nv04_crtc.c b/drivers/gpu/drm/nouveau/nv04_crtc.c
index 118261d4927..5e45398a9e2 100644
--- a/drivers/gpu/drm/nouveau/nv04_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv04_crtc.c
@@ -781,11 +781,20 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
         struct drm_device *dev = crtc->dev;
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
-        struct drm_framebuffer *drm_fb = nv_crtc->base.fb;
-        struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+        struct drm_framebuffer *drm_fb;
+        struct nouveau_framebuffer *fb;
         int arb_burst, arb_lwm;
         int ret;
 
+        NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+
+        /* no fb bound */
+        if (!atomic && !crtc->fb) {
+                NV_DEBUG_KMS(dev, "No FB bound\n");
+                return 0;
+        }
+
+
         /* If atomic, we want to switch to the fb we were passed, so
          * now we update pointers to do that.  (We don't pin; just
          * assume we're already pinned and update the base address.)
@@ -794,6 +803,8 @@ nv04_crtc_do_mode_set_base(struct drm_crtc *crtc,
                 drm_fb = passed_fb;
                 fb = nouveau_framebuffer(passed_fb);
         } else {
+                drm_fb = crtc->fb;
+                fb = nouveau_framebuffer(crtc->fb);
                 /* If not atomic, we can go ahead and pin, and unpin the
                  * old fb we were passed.
                  */