| Message ID | 20230102120123.19062-1-maxime@cerno.tech (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/bridge: panel: Prevent ERR_PTR Dereference | expand |
Hi Maxime, Thank you for the patch. On Mon, Jan 02, 2023 at 01:01:23PM +0100, Maxime Ripard wrote: > Commit 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to > drm_panel") introduced an access to the bridge pointer in the > devm_drm_panel_bridge_add_typed() function. > > However, due to the unusual ERR_PTR check when getting that pointer, the > pointer access is done even though the pointer might be an error > pointer. > > Rework the function for a more traditional design that will return > immediately if it gets an ERR_PTR so that we never access the pointer in > that case. > > Fixes: 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel") > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <error27@gmail.com> > Signed-off-by: Maxime Ripard <maxime@cerno.tech> Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> > --- > drivers/gpu/drm/bridge/panel.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c > index 1708098fba6d..e8aae3cdc73d 100644 > --- a/drivers/gpu/drm/bridge/panel.c > +++ b/drivers/gpu/drm/bridge/panel.c > @@ -357,15 +357,16 @@ struct drm_bridge *devm_drm_panel_bridge_add_typed(struct device *dev, > return ERR_PTR(-ENOMEM); > > bridge = drm_panel_bridge_add_typed(panel, connector_type); > - if (!IS_ERR(bridge)) { > - *ptr = bridge; > - devres_add(dev, ptr); > - } else { > + if (IS_ERR(bridge)) { > devres_free(ptr); > + return bridge; > } > > bridge->pre_enable_prev_first = panel->prepare_prev_first; > > + *ptr = bridge; > + devres_add(dev, ptr); > + > return bridge; > } > EXPORT_SYMBOL(devm_drm_panel_bridge_add_typed);
On 02.01.2023 13:01, Maxime Ripard wrote: > Commit 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to > drm_panel") introduced an access to the bridge pointer in the > devm_drm_panel_bridge_add_typed() function. > > However, due to the unusual ERR_PTR check when getting that pointer, the > pointer access is done even though the pointer might be an error > pointer. > > Rework the function for a more traditional design that will return > immediately if it gets an ERR_PTR so that we never access the pointer in > that case. > > Fixes: 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel") > Reported-by: kernel test robot <lkp@intel.com> > Reported-by: Dan Carpenter <error27@gmail.com> > Signed-off-by: Maxime Ripard <maxime@cerno.tech> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Regards Andrzej > --- > drivers/gpu/drm/bridge/panel.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c > index 1708098fba6d..e8aae3cdc73d 100644 > --- a/drivers/gpu/drm/bridge/panel.c > +++ b/drivers/gpu/drm/bridge/panel.c > @@ -357,15 +357,16 @@ struct drm_bridge *devm_drm_panel_bridge_add_typed(struct device *dev, > return ERR_PTR(-ENOMEM); > > bridge = drm_panel_bridge_add_typed(panel, connector_type); > - if (!IS_ERR(bridge)) { > - *ptr = bridge; > - devres_add(dev, ptr); > - } else { > + if (IS_ERR(bridge)) { > devres_free(ptr); > + return bridge; > } > > bridge->pre_enable_prev_first = panel->prepare_prev_first; > > + *ptr = bridge; > + devres_add(dev, ptr); > + > return bridge; > } > EXPORT_SYMBOL(devm_drm_panel_bridge_add_typed);
On Mon, 02 Jan 2023 13:01:23 +0100, Maxime Ripard wrote: > Commit 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to > drm_panel") introduced an access to the bridge pointer in the > devm_drm_panel_bridge_add_typed() function. > > However, due to the unusual ERR_PTR check when getting that pointer, the > pointer access is done even though the pointer might be an error > pointer. > > [...] Applied to drm/drm-misc (drm-misc-next). Thanks! Maxime
diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c index 1708098fba6d..e8aae3cdc73d 100644 --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -357,15 +357,16 @@ struct drm_bridge *devm_drm_panel_bridge_add_typed(struct device *dev, return ERR_PTR(-ENOMEM); bridge = drm_panel_bridge_add_typed(panel, connector_type); - if (!IS_ERR(bridge)) { - *ptr = bridge; - devres_add(dev, ptr); - } else { + if (IS_ERR(bridge)) { devres_free(ptr); + return bridge; } bridge->pre_enable_prev_first = panel->prepare_prev_first; + *ptr = bridge; + devres_add(dev, ptr); + return bridge; } EXPORT_SYMBOL(devm_drm_panel_bridge_add_typed);
Commit 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel") introduced an access to the bridge pointer in the devm_drm_panel_bridge_add_typed() function. However, due to the unusual ERR_PTR check when getting that pointer, the pointer access is done even though the pointer might be an error pointer. Rework the function for a more traditional design that will return immediately if it gets an ERR_PTR so that we never access the pointer in that case. Fixes: 5ea6b1702781 ("drm/panel: Add prepare_prev_first flag to drm_panel") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Maxime Ripard <maxime@cerno.tech> --- drivers/gpu/drm/bridge/panel.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)