linux-kernel - Re: [PATCH] drm/fb-helper: Fix potential NULL pointer dereference

Open Source and information security mailing list archives

Message-ID: <20171206091254.cwc3jxwvt27fd5gu@phenom.ffwll.local>
Date:   Wed, 6 Dec 2017 10:12:54 +0100
From:   Daniel Vetter <daniel@...ll.ch>
To:     "Gustavo A. R. Silva" <garsilva@...eddedor.com>
Cc:     Daniel Vetter <daniel.vetter@...el.com>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        Gustavo Padovan <gustavo@...ovan.org>,
        Sean Paul <seanpaul@...omium.org>,
        David Airlie <airlied@...ux.ie>, linux-kernel@...r.kernel.org,
        dri-devel@...ts.freedesktop.org
Subject: Re: [PATCH] drm/fb-helper: Fix potential NULL pointer dereference

On Tue, Dec 05, 2017 at 11:46:28AM -0600, Gustavo A. R. Silva wrote:
> fb_helper is being dereferenced before it is null checked,
> hence there is a potential null pointer dereference.
> 
> Fix this by moving the pointer dereference after fb_helper
> has been null checked.
> 
> This issue was detected with the help of Coccinelle.
> 
> Fixes: c777990fb45b ("drm/fb-helper: Handle function NULL argument")
> Signed-off-by: Gustavo A. R. Silva <garsilva@...eddedor.com>

Oops. Applied to drm-misc-next, thanks for your patch.
-Daniel

> ---
>  drivers/gpu/drm/drm_fb_helper.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
> index 6654f2f..04a3a5c 100644
> --- a/drivers/gpu/drm/drm_fb_helper.c
> +++ b/drivers/gpu/drm/drm_fb_helper.c
> @@ -178,7 +178,7 @@ EXPORT_SYMBOL(drm_fb_helper_add_one_connector);
>   */
>  int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
>  {
> -	struct drm_device *dev = fb_helper->dev;
> +	struct drm_device *dev;
>  	struct drm_connector *connector;
>  	struct drm_connector_list_iter conn_iter;
>  	int i, ret = 0;
> @@ -186,6 +186,8 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
>  	if (!drm_fbdev_emulation || !fb_helper)
>  		return 0;
>  
> +	dev = fb_helper->dev;
> +
>  	mutex_lock(&fb_helper->lock);
>  	drm_connector_list_iter_begin(dev, &conn_iter);
>  	drm_for_each_connector_iter(connector, &conn_iter) {
> -- 
> 2.7.4
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@...ts.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives