linux-kernel - Re: [PATCH v1 2/2] drm/sprd: fix potential NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0963819e-6739-2ad9-c5d8-dc3529032d22@suse.de>
Date:   Tue, 11 Jan 2022 10:31:17 +0100
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Kevin Tang <kevin3.tang@...il.com>,
        maarten.lankhorst@...ux.intel.com, mripard@...nel.org,
        sean@...rly.run, airlied@...ux.ie, daniel@...ll.ch,
        robh+dt@...nel.org, mark.rutland@....com
Cc:     devicetree@...r.kernel.org, zhang.lyra@...il.com,
        linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        lukas.bulwahn@...il.com, orsonzhai@...il.com, zou_wei@...wei.com,
        pony1.wu@...il.com, dan.carpenter@...cle.com
Subject: Re: [PATCH v1 2/2] drm/sprd: fix potential NULL dereference

Hi,

on the changes for platform_get_resource(), you can

Acked-by: Thomas Zimmermann <tzimmermann@...e.de>

but see my comments below.

Am 24.12.21 um 15:12 schrieb Kevin Tang:
> platform_get_resource() may fail and return NULL, so check it's value
> before using it.
> 
> 'drm' could be null in sprd_drm_shutdown, and drm_warn maybe dereference
> it, remove this warning log.
> 
> Cc: Orson Zhai <orsonzhai@...il.com>
> Cc: Chunyan Zhang <zhang.lyra@...il.com>
> Signed-off-by: Kevin Tang <kevin.tang@...soc.com>
> ---
>   drivers/gpu/drm/sprd/sprd_dpu.c | 3 +++
>   drivers/gpu/drm/sprd/sprd_drm.c | 8 ++------
>   drivers/gpu/drm/sprd/sprd_dsi.c | 3 +++
>   3 files changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/sprd/sprd_dpu.c b/drivers/gpu/drm/sprd/sprd_dpu.c
> index 06a3414ee..69683b7ba 100644
> --- a/drivers/gpu/drm/sprd/sprd_dpu.c
> +++ b/drivers/gpu/drm/sprd/sprd_dpu.c
> @@ -790,6 +790,9 @@ static int sprd_dpu_context_init(struct sprd_dpu *dpu,
>   	int ret;
>   
>   	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> +	if (!res)
> +		return -EINVAL;
> +

You can add an error message if this fails.


>   	ctx->base = devm_ioremap(dev, res->start, resource_size(res));
>   	if (!ctx->base) {
>   		dev_err(dev, "failed to map dpu registers\n");
> diff --git a/drivers/gpu/drm/sprd/sprd_drm.c b/drivers/gpu/drm/sprd/sprd_drm.c
> index a077e2d4d..54030839e 100644
> --- a/drivers/gpu/drm/sprd/sprd_drm.c
> +++ b/drivers/gpu/drm/sprd/sprd_drm.c
> @@ -154,12 +154,8 @@ static void sprd_drm_shutdown(struct platform_device *pdev)
>   {
>   	struct drm_device *drm = platform_get_drvdata(pdev);
>   
> -	if (!drm) {
> -		drm_warn(drm, "drm device is not available, no shutdown\n");
> -		return;
> -	}
> -
> -	drm_atomic_helper_shutdown(drm);
> +	if (drm)
> +		drm_atomic_helper_shutdown(drm);

This change should be in a separate patch. Instead of removing the 
warning, you should rather use dev_err() or dev_warn() from [1]. Not 
being able to shut down here looks like a serious driver bug that the 
user should know about.


>   }
>   
>   static const struct of_device_id drm_match_table[] = {
> diff --git a/drivers/gpu/drm/sprd/sprd_dsi.c b/drivers/gpu/drm/sprd/sprd_dsi.c
> index 911b3cddc..955c5995a 100644
> --- a/drivers/gpu/drm/sprd/sprd_dsi.c
> +++ b/drivers/gpu/drm/sprd/sprd_dsi.c
> @@ -907,6 +907,9 @@ static int sprd_dsi_context_init(struct sprd_dsi *dsi,
>   	struct resource *res;
>   
>   	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> +	if (!res)
> +		return -EINVAL;
> +

Again, an error message seems appropriate.

Best regards
Thomas

[1] 
https://elixir.bootlin.com/linux/latest/source/include/linux/dev_printk.h#L145

>   	ctx->base = devm_ioremap(dev, res->start, resource_size(res));
>   	if (!ctx->base) {
>   		drm_err(dsi->drm, "failed to map dsi host registers\n");

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)