diff mbox series

drm/msm: Fix potential NULL dereference in DPU

Message ID 20211020183837.959-1-jesszhan@codeaurora.org (mailing list archive)
State Not Applicable
Headers show
Series drm/msm: Fix potential NULL dereference in DPU | expand

Commit Message

Jessica Zhang Oct. 20, 2021, 6:38 p.m. UTC 
Add NULL checks in KMS CRTC funcs to avoid potential NULL
dereference.

Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jessica Zhang <jesszhan@codeaurora.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c      | 8 ++++++++
 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c          | 5 +++++
 drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c        | 3 +++
 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 3 +++
 drivers/gpu/drm/msm/msm_gpu.c                     | 3 +++
 5 files changed, 22 insertions(+)

Comments

Dmitry Baryshkov Nov. 25, 2021, 1:18 p.m. UTC | #1 
On 20/10/2021 21:38, Jessica Zhang wrote:
> Add NULL checks in KMS CRTC funcs to avoid potential NULL
> dereference.
> 
> Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")

I believe that single Fixes is incorrect here. For example snapshot 
support was added later. I'd suggest to split the patch and provide 
correct Fixes tags.

> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Jessica Zhang <jesszhan@codeaurora.org>
> ---
>   drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c      | 8 ++++++++

No such file.

>   drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c          | 5 +++++
>   drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c        | 3 +++
>   drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 3 +++
>   drivers/gpu/drm/msm/msm_gpu.c                     | 3 +++
>   5 files changed, 22 insertions(+)
> 
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
> index d2457490930b..53d80572181e 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
> @@ -208,8 +208,16 @@ void dpu_core_irq_preinstall(struct dpu_kms *dpu_kms)
>   	dpu_kms->irq_obj.total_irqs = dpu_kms->hw_intr->total_irqs;
>   	dpu_kms->irq_obj.irq_cb_tbl = kcalloc(dpu_kms->irq_obj.total_irqs,
>   			sizeof(struct list_head), GFP_KERNEL);
> +
> +	if (!dpu_kms->irq_obj.irq_cb_tbl)
> +		return;
> +
>   	dpu_kms->irq_obj.irq_counts = kcalloc(dpu_kms->irq_obj.total_irqs,
>   			sizeof(atomic_t), GFP_KERNEL);
> +
> +	if (!dpu_kms->irq_obj.irq_counts)
> +		return;
> +
>   	for (i = 0; i < dpu_kms->irq_obj.total_irqs; i++) {
>   		INIT_LIST_HEAD(&dpu_kms->irq_obj.irq_cb_tbl[i]);
>   		atomic_set(&dpu_kms->irq_obj.irq_counts[i], 0);
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> index 768012243b44..0a1cad0cfcc0 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> @@ -921,6 +921,11 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
>   
>   	pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL);
>   
> +	if (!pstates) {
> +		rc = -ENOMEM;
> +		goto end;
> +	}
> +
>   	if (!crtc_state->enable || !crtc_state->active) {
>   		DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
>   				crtc->base.id, crtc_state->enable,
> diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
> index c6b69afcbac8..09751b480db5 100644
> --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
> +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
> @@ -92,6 +92,9 @@ static void mdp5_plane_reset(struct drm_plane *plane)
>   	kfree(to_mdp5_plane_state(plane->state));
>   	mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL);
>   
> +	if (!mdp5_state)
> +		return;
> +
>   	if (plane->type == DRM_PLANE_TYPE_PRIMARY)
>   		mdp5_state->base.zpos = STAGE_BASE;
>   	else
> diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
> index cabe15190ec1..71e209d07120 100644
> --- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
> +++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
> @@ -170,6 +170,9 @@ void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len,
>   
>   	new_blk = kzalloc(sizeof(struct msm_disp_state_block), GFP_KERNEL);
>   
> +	if (!new_blk)
> +		return;
> +
>   	va_start(va, fmt);
>   
>   	vaf.fmt = fmt;
> diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
> index 8a3a592da3a4..ddd23f3a4a99 100644
> --- a/drivers/gpu/drm/msm/msm_gpu.c
> +++ b/drivers/gpu/drm/msm/msm_gpu.c
> @@ -296,6 +296,9 @@ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
>   		state->bos = kcalloc(nr,
>   			sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
>   
> +		if (!state->bos)
> +			return;
> +
>   		for (i = 0; i < submit->nr_bos; i++) {
>   			if (should_dump(submit, i)) {
>   				msm_gpu_crashstate_get_bo(state, submit->bos[i].obj,
>
diff mbox series

Patch

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
index d2457490930b..53d80572181e 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
@@ -208,8 +208,16 @@  void dpu_core_irq_preinstall(struct dpu_kms *dpu_kms)
 	dpu_kms->irq_obj.total_irqs = dpu_kms->hw_intr->total_irqs;
 	dpu_kms->irq_obj.irq_cb_tbl = kcalloc(dpu_kms->irq_obj.total_irqs,
 			sizeof(struct list_head), GFP_KERNEL);
+
+	if (!dpu_kms->irq_obj.irq_cb_tbl)
+		return;
+
 	dpu_kms->irq_obj.irq_counts = kcalloc(dpu_kms->irq_obj.total_irqs,
 			sizeof(atomic_t), GFP_KERNEL);
+
+	if (!dpu_kms->irq_obj.irq_counts)
+		return;
+
 	for (i = 0; i < dpu_kms->irq_obj.total_irqs; i++) {
 		INIT_LIST_HEAD(&dpu_kms->irq_obj.irq_cb_tbl[i]);
 		atomic_set(&dpu_kms->irq_obj.irq_counts[i], 0);
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index 768012243b44..0a1cad0cfcc0 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -921,6 +921,11 @@  static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
 
 	pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL);
 
+	if (!pstates) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
 	if (!crtc_state->enable || !crtc_state->active) {
 		DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
 				crtc->base.id, crtc_state->enable,
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
index c6b69afcbac8..09751b480db5 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
@@ -92,6 +92,9 @@  static void mdp5_plane_reset(struct drm_plane *plane)
 	kfree(to_mdp5_plane_state(plane->state));
 	mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL);
 
+	if (!mdp5_state)
+		return;
+
 	if (plane->type == DRM_PLANE_TYPE_PRIMARY)
 		mdp5_state->base.zpos = STAGE_BASE;
 	else
diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
index cabe15190ec1..71e209d07120 100644
--- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
+++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
@@ -170,6 +170,9 @@  void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len,
 
 	new_blk = kzalloc(sizeof(struct msm_disp_state_block), GFP_KERNEL);
 
+	if (!new_blk)
+		return;
+
 	va_start(va, fmt);
 
 	vaf.fmt = fmt;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 8a3a592da3a4..ddd23f3a4a99 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -296,6 +296,9 @@  static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
 		state->bos = kcalloc(nr,
 			sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
 
+		if (!state->bos)
+			return;
+
 		for (i = 0; i < submit->nr_bos; i++) {
 			if (should_dump(submit, i)) {
 				msm_gpu_crashstate_get_bo(state, submit->bos[i].obj,