diff mbox

[1/4] drm/i915: Don't leak edid in intel_crt_detect_ddc()

Message ID 1484922525-6131-1-git-send-email-ander.conselvan.de.oliveira@intel.com (mailing list archive)
State New, archived
Headers show

Commit Message

Ander Conselvan de Oliveira Jan. 20, 2017, 2:28 p.m. UTC 
In the path where intel_crt_detect_ddc() detects a CRT, if would return
true without freeing the edid.

Found by coverity.

Fixes: a2bd1f541f19 ("drm/i915: check whether we actually received an
edid in detect_ddc")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: intel-gfx@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.6+
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
---
 drivers/gpu/drm/i915/intel_crt.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comments

Ville Syrjälä Jan. 20, 2017, 3:02 p.m. UTC | #1 
On Fri, Jan 20, 2017 at 04:28:42PM +0200, Ander Conselvan de Oliveira wrote:
> In the path where intel_crt_detect_ddc() detects a CRT, if would return
> true without freeing the edid.
> 
> Found by coverity.
> 
> Fixes: a2bd1f541f19 ("drm/i915: check whether we actually received an
> edid in detect_ddc")
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: intel-gfx@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v3.6+
> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>

Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>

> ---
>  drivers/gpu/drm/i915/intel_crt.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
> index 385e29a..2bf5aca 100644
> --- a/drivers/gpu/drm/i915/intel_crt.c
> +++ b/drivers/gpu/drm/i915/intel_crt.c
> @@ -499,6 +499,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  	struct drm_i915_private *dev_priv = to_i915(crt->base.base.dev);
>  	struct edid *edid;
>  	struct i2c_adapter *i2c;
> +	bool ret = false;
>  
>  	BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
>  
> @@ -515,17 +516,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  		 */
>  		if (!is_digital) {
>  			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
> -			return true;
> +			ret = true;
> +		} else {
> +			DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  		}
> -
> -		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  	} else {
>  		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
>  	}
>  
>  	kfree(edid);
>  
> -	return false;
> +	return ret;
>  }
>  
>  static enum drm_connector_status
> -- 
> 2.5.5
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx
Jani Nikula Jan. 20, 2017, 3:09 p.m. UTC | #2 
On Fri, 20 Jan 2017, Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com> wrote:
> In the path where intel_crt_detect_ddc() detects a CRT, if would return
> true without freeing the edid.
>
> Found by coverity.
>
> Fixes: a2bd1f541f19 ("drm/i915: check whether we actually received an
> edid in detect_ddc")
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: intel-gfx@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v3.6+
> Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>

Reviewed-by: Jani Nikula <jani.nikula@intel.com>

> ---
>  drivers/gpu/drm/i915/intel_crt.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
> index 385e29a..2bf5aca 100644
> --- a/drivers/gpu/drm/i915/intel_crt.c
> +++ b/drivers/gpu/drm/i915/intel_crt.c
> @@ -499,6 +499,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  	struct drm_i915_private *dev_priv = to_i915(crt->base.base.dev);
>  	struct edid *edid;
>  	struct i2c_adapter *i2c;
> +	bool ret = false;
>  
>  	BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
>  
> @@ -515,17 +516,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
>  		 */
>  		if (!is_digital) {
>  			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
> -			return true;
> +			ret = true;
> +		} else {
> +			DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  		}
> -
> -		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
>  	} else {
>  		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
>  	}
>  
>  	kfree(edid);
>  
> -	return false;
> +	return ret;
>  }
>  
>  static enum drm_connector_status
Ander Conselvan de Oliveira Jan. 23, 2017, 8:40 a.m. UTC | #3 
On Fri, 2017-01-20 at 14:54 +0000, Patchwork wrote:
> == Series Details ==
> 
> Series: series starting with [1/4] drm/i915: Don't leak edid in
> intel_crt_detect_ddc()
> URL   : https://patchwork.freedesktop.org/series/18297/
> State : warning
> 
> == Summary ==
> 
> Series 18297v1 Series without cover letter
> https://patchwork.freedesktop.org/api/1.0/series/18297/revisions/1/mbox/
> 
> Test kms_force_connector_basic:
>         Subgroup force-edid:
>                 pass       -> DMESG-WARN (fi-snb-2520m)

[  426.182548] [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 255
[  426.488629] Setting dangerous option load_detect_test - tainting kernel
[  426.489253] Setting dangerous option load_detect_test - tainting kernel

https://bugs.freedesktop.org/show_bug.cgi?id=98625

Pushed. Thank you for reviewing.

Ander

> 
> fi-bdw-5557u     total:246  pass:232  dwarn:0   dfail:0   fail:0   skip:14 
> fi-bsw-n3050     total:246  pass:207  dwarn:0   dfail:0   fail:0   skip:39 
> fi-bxt-j4205     total:246  pass:224  dwarn:0   dfail:0   fail:0   skip:22 
> fi-bxt-t5700     total:79   pass:66   dwarn:0   dfail:0   fail:0   skip:12 
> fi-byt-j1900     total:246  pass:219  dwarn:0   dfail:0   fail:0   skip:27 
> fi-byt-n2820     total:246  pass:215  dwarn:0   dfail:0   fail:0   skip:31 
> fi-hsw-4770      total:246  pass:227  dwarn:0   dfail:0   fail:0   skip:19 
> fi-hsw-4770r     total:246  pass:227  dwarn:0   dfail:0   fail:0   skip:19 
> fi-ivb-3520m     total:246  pass:225  dwarn:0   dfail:0   fail:0   skip:21 
> fi-ivb-3770      total:246  pass:225  dwarn:0   dfail:0   fail:0   skip:21 
> fi-kbl-7500u     total:246  pass:225  dwarn:0   dfail:0   fail:0   skip:21 
> fi-skl-6260u     total:246  pass:233  dwarn:0   dfail:0   fail:0   skip:13 
> fi-skl-6700hq    total:246  pass:226  dwarn:0   dfail:0   fail:0   skip:20 
> fi-skl-6700k     total:246  pass:222  dwarn:3   dfail:0   fail:0   skip:21 
> fi-skl-6770hq    total:246  pass:233  dwarn:0   dfail:0   fail:0   skip:13 
> fi-snb-2520m     total:246  pass:214  dwarn:1   dfail:0   fail:0   skip:31 
> fi-snb-2600      total:246  pass:214  dwarn:0   dfail:0   fail:0   skip:32 
> 
> aa012aa081f6a6d2dd5a1df0f3c3736017df0d56 drm-tip: 2017y-01m-20d-09h-33m-30s
> UTC integration manifest
> ef1d3ae drm/i915: Check for NULL atomic state in intel_crtc_disable_noatomic()
> edf6276 drm/i915: Fix calculation of rotated x and y offsets for planar
> formats
> d1dea37 drm/i915: Don't init hpd polling for vlv and chv from
> runtime_suspend()
> 4f24c80 drm/i915: Don't leak edid in intel_crt_detect_ddc()
> 
> == Logs ==
> 
> For more details see: https://intel-gfx-ci.01.org/CI/Patchwork_3557/
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx
diff mbox

Patch

diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 385e29a..2bf5aca 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -499,6 +499,7 @@  static bool intel_crt_detect_ddc(struct drm_connector *connector)
 	struct drm_i915_private *dev_priv = to_i915(crt->base.base.dev);
 	struct edid *edid;
 	struct i2c_adapter *i2c;
+	bool ret = false;
 
 	BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG);
 
@@ -515,17 +516,17 @@  static bool intel_crt_detect_ddc(struct drm_connector *connector)
 		 */
 		if (!is_digital) {
 			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
-			return true;
+			ret = true;
+		} else {
+			DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
 		}
-
-		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n");
 	} else {
 		DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n");
 	}
 
 	kfree(edid);
 
-	return false;
+	return ret;
 }
 
 static enum drm_connector_status