linux-kernel - Re: [PATCH] video: fbdev: sis: fix null ptr dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2b8139d8-12c9-3685-9160-fc92ae08aac0@samsung.com>
Date:   Tue, 8 Sep 2020 13:37:02 +0200
From:   Bartlomiej Zolnierkiewicz <b.zolnierkie@...sung.com>
To:     trix@...hat.com
Cc:     thomas@...ischhofer.net, akpm@...l.org,
        dri-devel@...ts.freedesktop.org, linux-fbdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] video: fbdev: sis: fix null ptr dereference


On 8/5/20 4:52 PM, trix@...hat.com wrote:
> From: Tom Rix <trix@...hat.com>
> 
> Clang static analysis reports this representative error
> 
> init.c:2501:18: warning: Array access (from variable 'queuedata') results
>   in a null pointer dereference
>       templ |= ((queuedata[i] & 0xc0) << 3);
> 
> This is the problem block of code
> 
>    if(ModeNo > 0x13) {
>       ...
>       if(SiS_Pr->ChipType == SIS_730) {
> 	 queuedata = &FQBQData730[0];
>       } else {
> 	 queuedata = &FQBQData[0];
>       }
>    } else {
> 
>    }
> 
> queuedata is not set in the else block
> 
> Reviewing the old code, the arrays FQBQData730 and FQBQData were
> used directly.
> 
> So hoist the setting of queuedata out of the if-else block.
> 
> Fixes: 544393fe584d ("[PATCH] sisfb update")
> 
> Signed-off-by: Tom Rix <trix@...hat.com>

Applied to drm-misc-next tree, thanks.

Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics

> ---
>  drivers/video/fbdev/sis/init.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
> index dfe3eb769638..fde27feae5d0 100644
> --- a/drivers/video/fbdev/sis/init.c
> +++ b/drivers/video/fbdev/sis/init.c
> @@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
>  
>     i = 0;
>  
> +	if (SiS_Pr->ChipType == SIS_730)
> +		queuedata = &FQBQData730[0];
> +	else
> +		queuedata = &FQBQData[0];
> +
>     if(ModeNo > 0x13) {
>  
>        /* Get VCLK  */
> @@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
>        /* Get half colordepth */
>        colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
>  
> -      if(SiS_Pr->ChipType == SIS_730) {
> -	 queuedata = &FQBQData730[0];
> -      } else {
> -	 queuedata = &FQBQData[0];
> -      }
> -
>        do {
>  	 templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
>  
>