linux-kernel - drm: Possible NULL ptr exceptions in other DRM drivers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <1404376434.27983.22.camel@AMDC1943>
Date:	Thu, 03 Jul 2014 10:33:54 +0200
From:	Krzysztof Kozlowski <k.kozlowski@...sung.com>
To:	David Airlie <airlied@...ux.ie>,
	Thomas Hellstrom <thellstrom@...are.com>,
	dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
	Daniel Vetter <daniel.vetter@...ll.ch>,
	BenSkeggs <bskeggs@...hat.com>, RobClark <robdclark@...il.com>,
	GerdHoffmann <kraxel@...hat.com>
Subject: drm: Possible NULL ptr exceptions in other DRM drivers

Hi,

In Exynos DRM driver I found a NULL pointer exception when there were no
components set for DRM driver:
https://lkml.org/lkml/2014/6/30/331

The NULL pointer will happen during driver suspend if drm_driver.load()
is not called. The load() won't be called if no components are added.

After looking at other DRM drivers it seems that they may also be
affected by this issue. Some possible candidates (for my amateur's eyes)
are:
1. vmwgfx/vmwgfx_drv.c (vmw_pci_suspend: dereference of 'dev_priv')
2. qxl/qxl_drv.c (qxl_drm_freeze: dereference of 'qdev')
3. nouveau/nouveau_drm.c (nouveau_do_suspend: dereference of 'drm')
4. msm/msm_drv.c (msm_pm_suspend: dereference of 'ddev')
5. cirrus/cirrus_drv.c (cirrus_pm_suspend: dereference of 'cdev')
6. bochs/bochs_drv.c (bochs_pm_suspend: dereference of 'bochs')

Unfortunately I am not familiar with DRM drivers and I do not have
hardware to test it.

Maybe it is worth looking at?

Best regards,
Krzysztof

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/