From patchwork Tue Nov 5 11:12:18 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Biju Das X-Patchwork-Id: 13862813 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3EB6ED12687 for ; Tue, 5 Nov 2024 11:12:44 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id AEFA110E56E; Tue, 5 Nov 2024 11:12:43 +0000 (UTC) Received: from relmlie6.idc.renesas.com (relmlor2.renesas.com [210.160.252.172]) by gabe.freedesktop.org (Postfix) with ESMTP id E55D410E56E for ; Tue, 5 Nov 2024 11:12:42 +0000 (UTC) X-IronPort-AV: E=Sophos;i="6.11,259,1725289200"; d="scan'208";a="227919676" Received: from unknown (HELO relmlir6.idc.renesas.com) ([10.200.68.152]) by relmlie6.idc.renesas.com with ESMTP; 05 Nov 2024 20:12:42 +0900 Received: from localhost.localdomain (unknown [10.226.92.174]) by relmlir6.idc.renesas.com (Postfix) with ESMTP id F1F8941D0AB3; Tue, 5 Nov 2024 20:12:36 +0900 (JST) From: Biju Das To: Andrzej Hajda , Neil Armstrong , Robert Foss , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: Biju Das , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Archit Taneja , dri-devel@lists.freedesktop.org, Geert Uytterhoeven , Prabhakar Mahadev Lad , Biju Das , linux-renesas-soc@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 1/2] drm: adv7511: Fix use-after-free in adv7533_attach_dsi() Date: Tue, 5 Nov 2024 11:12:18 +0000 Message-ID: <20241105111228.112813-2-biju.das.jz@bp.renesas.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20241105111228.112813-1-biju.das.jz@bp.renesas.com> References: <20241105111228.112813-1-biju.das.jz@bp.renesas.com> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" The host_node pointer assigned and freed in adv7533_parse_dt() and later adv7533_attach_dsi() uses the same. Fix this issue by freeing the host_node in adv7533_attach_dsi() instead of adv7533_parse_dt(). Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device") Cc: stable@vger.kernel.org Signed-off-by: Biju Das --- Changes in v2: - Added the tag "Cc: stable@vger.kernel.org" in the sign-off area. - Dropped Archit Taneja invalid Mail address --- drivers/gpu/drm/bridge/adv7511/adv7533.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c index 4481489aaf5e..3e57ba838e5e 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7533.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c @@ -133,6 +133,7 @@ int adv7533_patch_cec_registers(struct adv7511 *adv) int adv7533_attach_dsi(struct adv7511 *adv) { + struct device_node *np __free(device_node) = adv->host_node; struct device *dev = &adv->i2c_main->dev; struct mipi_dsi_host *host; struct mipi_dsi_device *dsi; @@ -181,8 +182,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) if (!adv->host_node) return -ENODEV; - of_node_put(adv->host_node); - adv->use_timing_gen = !of_property_read_bool(np, "adi,disable-timing-generator"); From patchwork Tue Nov 5 11:12:19 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Biju Das X-Patchwork-Id: 13862814 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AA681D12685 for ; Tue, 5 Nov 2024 11:12:57 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 2AE0210E56F; Tue, 5 Nov 2024 11:12:57 +0000 (UTC) Received: from relmlie6.idc.renesas.com (relmlor2.renesas.com [210.160.252.172]) by gabe.freedesktop.org (Postfix) with ESMTP id 97B6110E56F for ; Tue, 5 Nov 2024 11:12:55 +0000 (UTC) X-IronPort-AV: E=Sophos;i="6.11,259,1725289200"; d="scan'208";a="227919685" Received: from unknown (HELO relmlir6.idc.renesas.com) ([10.200.68.152]) by relmlie6.idc.renesas.com with ESMTP; 05 Nov 2024 20:12:55 +0900 Received: from localhost.localdomain (unknown [10.226.92.174]) by relmlir6.idc.renesas.com (Postfix) with ESMTP id BD90041D0022; Tue, 5 Nov 2024 20:12:42 +0900 (JST) From: Biju Das To: Andrzej Hajda , Neil Armstrong , Robert Foss , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: Biju Das , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Archit Taneja , dri-devel@lists.freedesktop.org, Geert Uytterhoeven , Prabhakar Mahadev Lad , Biju Das , linux-renesas-soc@vger.kernel.org, Hien Huynh Subject: [PATCH v2 2/2] drm: adv7511: Fix out-of-bounds array in clock_div_by_lanes Date: Tue, 5 Nov 2024 11:12:19 +0000 Message-ID: <20241105111228.112813-3-biju.das.jz@bp.renesas.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20241105111228.112813-1-biju.das.jz@bp.renesas.com> References: <20241105111228.112813-1-biju.das.jz@bp.renesas.com> MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Fix out-of-bounds array in adv7511_dsi_config_timing_gen(), when dsi lanes = 1. Fixes: 78fa479d703c ("drm/bridge: adv7533: Use internal timing generator") Reported-by: Hien Huynh Signed-off-by: Biju Das --- Changes in v2: - Added the tag "Cc: stable@vger.kernel.org" in the sign-off area. - Dropped Archit Taneja invalid Mail address --- drivers/gpu/drm/bridge/adv7511/adv7533.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c index 3e57ba838e5e..0c2236e53af5 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7533.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c @@ -185,6 +185,9 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) adv->use_timing_gen = !of_property_read_bool(np, "adi,disable-timing-generator"); + if (adv->use_timing_gen && num_lanes == 1) + return -EINVAL; + /* TODO: Check if these need to be parsed by DT or not */ adv->rgb = true; adv->embedded_sync = false;