| Message ID | 20240826052652.2565521-1-make24@iscas.ac.cn (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [RESEND] drm/sti: avoid potential dereference of error pointers | expand |
Le 26/08/2024 à 07:26, Ma Ke a écrit : > The return value of drm_atomic_get_crtc_state() needs to be > checked. To avoid use of error pointer 'crtc_state' in case > of the failure. > > Cc: stable@vger.kernel.org > Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check") > > Signed-off-by: Ma Ke <make24@iscas.ac.cn> > Hi, Tested-by: Raphaël Gallais-Pou <rgallaispou@gmail.com> Regards, Raphaël
Hi, Thanks for your patch. Acked-by: Alain Volmat <alain.volmat@foss.st.com> Regards, Alain On Mon, Aug 26, 2024 at 01:26:52PM +0800, Ma Ke wrote: > The return value of drm_atomic_get_crtc_state() needs to be > checked. To avoid use of error pointer 'crtc_state' in case > of the failure. > > Cc: stable@vger.kernel.org > Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check") > > Signed-off-by: Ma Ke <make24@iscas.ac.cn> > --- > drivers/gpu/drm/sti/sti_cursor.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c > index db0a1eb53532..e460f5ba2d87 100644 > --- a/drivers/gpu/drm/sti/sti_cursor.c > +++ b/drivers/gpu/drm/sti/sti_cursor.c > @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane, > return 0; > > crtc_state = drm_atomic_get_crtc_state(state, crtc); > + if (IS_ERR(crtc_state)) > + return PTR_ERR(crtc_state); > mode = &crtc_state->mode; > dst_x = new_plane_state->crtc_x; > dst_y = new_plane_state->crtc_y; > -- > 2.25.1 >
Hi,
I probably went a bit fast on the commit message. It seems to me that
the Fixes line would be probably better with below one instead.
Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
The same fix is actually necessary for all planes (cursor / gdp / hqvdp),
which is related to the same original commit. Hence sti_cursor/sti_gdp
and sti_hqvdp.
Would you be ok to have those 3 fixes within a commit ?
Regards,
Alain
On Tue, Sep 10, 2024 at 07:25:43PM +0200, Alain Volmat wrote:
> Hi,
>
> Thanks for your patch.
>
> Acked-by: Alain Volmat <alain.volmat@foss.st.com>
>
> Regards,
> Alain
>
> On Mon, Aug 26, 2024 at 01:26:52PM +0800, Ma Ke wrote:
> > The return value of drm_atomic_get_crtc_state() needs to be
> > checked. To avoid use of error pointer 'crtc_state' in case
> > of the failure.
> >
> > Cc: stable@vger.kernel.org
> > Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check")
> >
> > Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> > ---
> > drivers/gpu/drm/sti/sti_cursor.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
> > index db0a1eb53532..e460f5ba2d87 100644
> > --- a/drivers/gpu/drm/sti/sti_cursor.c
> > +++ b/drivers/gpu/drm/sti/sti_cursor.c
> > @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
> > return 0;
> >
> > crtc_state = drm_atomic_get_crtc_state(state, crtc);
> > + if (IS_ERR(crtc_state))
> > + return PTR_ERR(crtc_state);
> > mode = &crtc_state->mode;
> > dst_x = new_plane_state->crtc_x;
> > dst_y = new_plane_state->crtc_y;
> > --
> > 2.25.1
> >
Alain Volmat<alain.volmat@foss.st.com> wrote: > Hi, > > I probably went a bit fast on the commit message. It seems to me that > the Fixes line would be probably better with below one instead. > > Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") > > The same fix is actually necessary for all planes (cursor / gdp / hqvdp), > which is related to the same original commit. Hence sti_cursor/sti_gdp > and sti_hqvdp. > > Would you be ok to have those 3 fixes within a commit ? > > Regards, > Alain > > On Tue, Sep 10, 2024 at 07:25:43PM +0200, Alain Volmat wrote: > > Hi, > > > > Thanks for your patch. > > > > Acked-by: Alain Volmat <alain.volmat@foss.st.com> > > > > Regards, > > Alain > > > > On Mon, Aug 26, 2024 at 01:26:52PM +0800, Ma Ke wrote: > > > The return value of drm_atomic_get_crtc_state() needs to be > > > checked. To avoid use of error pointer 'crtc_state' in case > > > of the failure. > > > > > > Cc: stable@vger.kernel.org > > > Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check") > > > > > > Signed-off-by: Ma Ke <make24@iscas.ac.cn> > > > --- > > > drivers/gpu/drm/sti/sti_cursor.c | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > > > diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c > > > index db0a1eb53532..e460f5ba2d87 100644 > > > --- a/drivers/gpu/drm/sti/sti_cursor.c > > > +++ b/drivers/gpu/drm/sti/sti_cursor.c > > > @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane, > > > return 0; > > > > > > crtc_state = drm_atomic_get_crtc_state(state, crtc); > > > + if (IS_ERR(crtc_state)) > > > + return PTR_ERR(crtc_state); > > > mode = &crtc_state->mode; > > > dst_x = new_plane_state->crtc_x; > > > dst_y = new_plane_state->crtc_y; > > > -- > > > 2.25.1 > > > Hi， I appreciate your guidance regarding the modification of the Fixes tag. As your observation, I have also identified the additional instance (sti_hqvdp_atomic_check) where a similar issue exists, necessitating the same patch. I have recognized the problem and was in the process of reporting it. To prevent any confusion and ensure accurate reporting, I have updated the patch already submitted as patch v2. The issue in sti_hqvdp_atomic_check has also been reported, and I kindly request you to review it.(I am not very familiar with how to combine the reporting of vulnerabilities in multiple functions, so to avoid unnecessary errors or confusion, I reported them one by one. Hope for your understanding.) Thank you for your prompt response. Your assistance is invaluable to me. Best regards, Ma Ke
diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c index db0a1eb53532..e460f5ba2d87 100644 --- a/drivers/gpu/drm/sti/sti_cursor.c +++ b/drivers/gpu/drm/sti/sti_cursor.c @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane, return 0; crtc_state = drm_atomic_get_crtc_state(state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y;
The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable@vger.kernel.org Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check") Signed-off-by: Ma Ke <make24@iscas.ac.cn> --- drivers/gpu/drm/sti/sti_cursor.c | 2 ++ 1 file changed, 2 insertions(+)