linux-kernel - Re: [PATCH] drm/mcde: dsi: Fix invalid pointer dereference if panel cannot be found

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 20 Nov 2019 21:32:52 +0100
From:   Linus Walleij <linus.walleij@...aro.org>
To:     Stephan Gerhold <stephan@...hold.net>
Cc:     David Airlie <airlied@...ux.ie>, Daniel Vetter <daniel@...ll.ch>,
        "open list:DRM PANEL DRIVERS" <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/mcde: dsi: Fix invalid pointer dereference if panel
 cannot be found

On Mon, Nov 18, 2019 at 2:04 PM Stephan Gerhold <stephan@...hold.net> wrote:

> The "panel" pointer is not reset to NULL if of_drm_find_panel()
> returns an error. Therefore we later assume that a panel was found,
> and try to dereference the error pointer, resulting in:
>
>     mcde-dsi a0351000.dsi: failed to find panel try bridge (4294966779)
>     Unable to handle kernel paging request at virtual address fffffe03
>     PC is at drm_panel_bridge_add.part.0+0x10/0x5c
>     LR is at mcde_dsi_bind+0x120/0x464
>     ...
>
> Reset "panel" to NULL to avoid this problem.
> Also change the format string of the error to %ld to print
> the negative errors correctly. The crash above then becomes:
>
>     mcde-dsi a0351000.dsi: failed to find panel try bridge (-517)
>     mcde-dsi a0351000.dsi: no panel or bridge
>     ...
>
> Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE")
> Signed-off-by: Stephan Gerhold <stephan@...hold.net>

Patch applied and pushed to drm-misc-fixes, thanks!

Yours,
Linus Walleij