From patchwork Thu Feb 22 06:09:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Oleksandr Andrushchenko X-Patchwork-Id: 10234689 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id ACDD760349 for ; Thu, 22 Feb 2018 06:09:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A99B8288D1 for ; Thu, 22 Feb 2018 06:09:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9AD64288D7; Thu, 22 Feb 2018 06:09:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id F233B288D1 for ; Thu, 22 Feb 2018 06:09:32 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 00B126EBD4; Thu, 22 Feb 2018 06:09:32 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-lf0-x241.google.com (mail-lf0-x241.google.com [IPv6:2a00:1450:4010:c07::241]) by gabe.freedesktop.org (Postfix) with ESMTPS id D36516EBD4 for ; Thu, 22 Feb 2018 06:09:30 +0000 (UTC) Received: by mail-lf0-x241.google.com with SMTP id f75so732086lfg.6 for ; Wed, 21 Feb 2018 22:09:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=McsLnZDWjqXo5gx9n50oDAhTIs9tJyBPGZUXyreag3w=; b=EpxgxoaLgt+iTCWO/2DgCdqoBbkn8KuLVlZeuQ/Ed1F6k0tiMTyIiUiCSx5MZRZ4bB GVSeJD+LlQHd+eB/S+XFl4qKp18OV24DUA9kL/KXhddzhzV3L2YO80qwweTmDjdkNEb6 cQZ9E2BLUqvALMwB2Pg9uotHHbj/CzDK0j9GIwVZLSylKIYm7Il2qKmYHUMF+/4pN7jS fDa9AZ+nQqWmOxYu540ktTJV8nV0ucm/Xy0V0E4dNu0Fv2aik38kiicT5QdjsZ8+lVUx nMyUlPwigia+SoN0jg7Z+bB1xCCJOAEhQtin0jNYsWKtEarTZ/5jE/X2IHN5lvVJC2Y/ HfpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=McsLnZDWjqXo5gx9n50oDAhTIs9tJyBPGZUXyreag3w=; b=Q61Ejl6LdLCtFzvpJ81zEhhHypP35nRYH1w0NuieL1P+SY8F+clX3MQdg3qcEPZ7An rCw1ZmlkuYJ/rKUsSdgIYk1DkgV1/VUN2dnuS1eo/pUbF9/iycUhboMw2yLCldgSSQKL T4Jo4CDIQe5BEoRYYDaaKmzx+omaXWMqOygiKvoCk8R8E3XRwLvtmk2KbnpCJxKpjIZ3 iHlvRx4l6gbNxe22gHsplAXDX4HpKA8ToJc2tNzrwp0ZWNSLK6fC8OF8mVAkMxaPn/wY j7OURjisDC0beFDJbssuFOobseHSvelehlGVU1AosuiUdQdf6iq3f2QAug4k04FiN4ji ZRjg== X-Gm-Message-State: APf1xPAWsuVa0L8FqIPQMltRppJtRjol/IjHkbqY+PkCV6zi5tskyofZ NExUDxbz+e54V5/xE/LjW5iv3w3i X-Google-Smtp-Source: AH8x225YJAMh9n+KbIwX+XacfDEr16r2DDzHm8VvBqtA0940hJsBDniAP6QzDrIEX8FmpQfX8Jeqng== X-Received: by 10.46.77.68 with SMTP id a65mr3896049ljb.100.1519279768804; Wed, 21 Feb 2018 22:09:28 -0800 (PST) Received: from a2k-HP-ProDesk-600-G2-SFF.kyiv.epam.com (ll-51.209.223.85.sovam.net.ua. [85.223.209.51]) by smtp.gmail.com with ESMTPSA id z130sm1431908lff.59.2018.02.21.22.09.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 21 Feb 2018 22:09:27 -0800 (PST) From: Oleksandr Andrushchenko To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, daniel.vetter@intel.com Subject: [PATCH v1] drm/simple_kms_helper: Fix NULL pointer dereference with no active CRTC Date: Thu, 22 Feb 2018 08:09:19 +0200 Message-Id: <1519279759-7803-1-git-send-email-andr2000@gmail.com> X-Mailer: git-send-email 2.7.4 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: airlied@linux.ie, andr2000@gmail.com, Oleksandr Andrushchenko MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Oleksandr Andrushchenko It is possible that drm_simple_kms_plane_atomic_check called with no CRTC set, e.g. when user-space application sets CRTC_ID/FB_ID to 0 before doing any actual drawing. This leads to NULL pointer dereference because in this case new CRTC state is NULL and must be checked before accessing. Signed-off-by: Oleksandr Andrushchenko Reviewed-by: Daniel Vetter --- Changes since initial: - re-worked checks for null CRTC as suggested by Daniel Vetter --- drivers/gpu/drm/drm_simple_kms_helper.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/drm_simple_kms_helper.c b/drivers/gpu/drm/drm_simple_kms_helper.c index 9ca8a4a59b74..4a1dbd88b1ec 100644 --- a/drivers/gpu/drm/drm_simple_kms_helper.c +++ b/drivers/gpu/drm/drm_simple_kms_helper.c @@ -121,12 +121,6 @@ static int drm_simple_kms_plane_atomic_check(struct drm_plane *plane, pipe = container_of(plane, struct drm_simple_display_pipe, plane); crtc_state = drm_atomic_get_new_crtc_state(plane_state->state, &pipe->crtc); - if (!crtc_state->enable) - return 0; /* nothing to check when disabling or disabled */ - - if (crtc_state->enable) - drm_mode_get_hv_timing(&crtc_state->mode, - &clip.x2, &clip.y2); ret = drm_atomic_helper_check_plane_state(plane_state, crtc_state, &clip, @@ -137,7 +131,9 @@ static int drm_simple_kms_plane_atomic_check(struct drm_plane *plane, return ret; if (!plane_state->visible) - return -EINVAL; + return 0; + + drm_mode_get_hv_timing(&crtc_state->mode, &clip.x2, &clip.y2); if (!pipe->funcs || !pipe->funcs->check) return 0;