linux-kernel - Re: [PATCH v8 1/3] gpu: drm: separate panel orientation property creating and value setting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87czjoixno.fsf@collabora.com>
Date:   Mon, 14 Feb 2022 23:03:39 -0500
From:   Gabriel Krisman Bertazi <krisman@...labora.com>
To:     Hsin-Yi Wang <hsinyi@...omium.org>
Cc:     dri-devel@...ts.freedesktop.org, David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>, amd-gfx@...ts.freedesktop.org,
        intel-gfx@...ts.freedesktop.org,
        Chun-Kuang Hu <chunkuang.hu@...nel.org>,
        Sean Paul <sean@...rly.run>,
        Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
        Maxime Ripard <mripard@...nel.org>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        linux-kernel@...r.kernel.org, Rob Herring <robh+dt@...nel.org>,
        Matthias Brugger <matthias.bgg@...il.com>,
        devicetree@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-mediatek@...ts.infradead.org,
        Simon Ser <contact@...rsion.fr>,
        Harry Wentland <harry.wentland@....com>,
        Alex Deucher <alexander.deucher@....com>,
        Jani Nikula <jani.nikula@...ux.intel.com>
Subject: Re: [PATCH v8 1/3] gpu: drm: separate panel orientation property
 creating and value setting

Hsin-Yi Wang <hsinyi@...omium.org> writes:

> On Tue, Feb 15, 2022 at 9:17 AM Gabriel Krisman Bertazi
> <krisman@...labora.com> wrote:
>>
>> Hsin-Yi Wang <hsinyi@...omium.org> writes:
>>
>> > drm_dev_register() sets connector->registration_state to
>> > DRM_CONNECTOR_REGISTERED and dev->registered to true. If
>> > drm_connector_set_panel_orientation() is first called after
>> > drm_dev_register(), it will fail several checks and results in following
>> > warning.
>>
>> Hi,
>>
>> I stumbled upon this when investigating the same WARN_ON on amdgpu.
>> Thanks for the patch :)
>>
>> > diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
>> > index a50c82bc2b2fec..572ead7ac10690 100644
>> > --- a/drivers/gpu/drm/drm_connector.c
>> > +++ b/drivers/gpu/drm/drm_connector.c
>> > @@ -1252,7 +1252,7 @@ static const struct drm_prop_enum_list dp_colorspaces[] = {
>> >   *   INPUT_PROP_DIRECT) will still map 1:1 to the actual LCD panel
>> >   *   coordinates, so if userspace rotates the picture to adjust for
>> >   *   the orientation it must also apply the same transformation to the
>> > - *   touchscreen input coordinates. This property is initialized by calling
>> > + *   touchscreen input coordinates. This property value is set by calling
>> >   *   drm_connector_set_panel_orientation() or
>> >   *   drm_connector_set_panel_orientation_with_quirk()
>> >   *
>> > @@ -2341,8 +2341,8 @@ EXPORT_SYMBOL(drm_connector_set_vrr_capable_property);
>> >   * @connector: connector for which to set the panel-orientation property.
>> >   * @panel_orientation: drm_panel_orientation value to set
>> >   *
>> > - * This function sets the connector's panel_orientation and attaches
>> > - * a "panel orientation" property to the connector.
>> > + * This function sets the connector's panel_orientation value. If the property
>> > + * doesn't exist, it will try to create one.
>> >   *
>> >   * Calling this function on a connector where the panel_orientation has
>> >   * already been set is a no-op (e.g. the orientation has been overridden with
>> > @@ -2373,19 +2373,12 @@ int drm_connector_set_panel_orientation(
>> >       info->panel_orientation = panel_orientation;
>> >
>> >       prop = dev->mode_config.panel_orientation_property;
>> > -     if (!prop) {
>> > -             prop = drm_property_create_enum(dev, DRM_MODE_PROP_IMMUTABLE,
>> > -                             "panel orientation",
>> > -                             drm_panel_orientation_enum_list,
>> > -                             ARRAY_SIZE(drm_panel_orientation_enum_list));
>> > -             if (!prop)
>> > -                     return -ENOMEM;
>> > -
>> > -             dev->mode_config.panel_orientation_property = prop;
>> > -     }
>> > +     if (!prop &&
>> > +         drm_connector_init_panel_orientation_property(connector) < 0)
>> > +             return -ENOMEM;
>> >
>>
>> In the case where the property has not been created beforehand, you
>> forgot to reinitialize prop here, after calling
>> drm_connector_init_panel_orientation_property().  This means
> hi Gabriel,
>
> drm_connector_init_panel_orientation_property() will create prop if
> it's null. If prop fails to be created there, it will return -ENOMEM.

Yes.  But *after the property is successfully created*, the prop variable is still
NULL.  And then you call the following, using prop, which is still NULL:

>> > +     drm_object_property_set_value(&connector->base, prop,
>> > +                                   info->panel_orientation);

This will do property->dev right on the first line of code, and dereference the
null prop pointer.

You must do

  prop = dev->mode_config.panel_orientation_property;

again after drm_connector_init_panel_orientation_property successfully
returns, or call drm_object_property_set_value using
dev->mode_config.panel_orientation_property directly:

  drm_object_property_set_value(&connector->base,
			dev->mode_config.panel_orientation_property
		        info->panel_orientation);

-- 
Gabriel Krisman Bertazi