linux-kernel - Re: [PATCH v2] drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 2 Feb 2023 10:56:39 +0100
From:   Matthias Brugger <matthias.bgg@...il.com>
To:     Chen-Yu Tsai <wenst@...omium.org>,
        Chun-Kuang Hu <chunkuang.hu@...nel.org>,
        Philipp Zabel <p.zabel@...gutronix.de>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>
Cc:     dri-devel@...ts.freedesktop.org,
        linux-mediatek@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Guillaume Ranquet <granquet@...libre.com>
Subject: Re: [PATCH v2] drm/mediatek: dp: Only trigger DRM HPD events if
 bridge is attached



On 02/02/2023 05:57, Chen-Yu Tsai wrote:
> The MediaTek DisplayPort interface bridge driver starts its interrupts
> as soon as its probed. However when the interrupts trigger the bridge
> might not have been attached to a DRM device. As drm_helper_hpd_irq_event()
> does not check whether the passed in drm_device is valid or not, a NULL
> pointer passed in results in a kernel NULL pointer dereference in it.
> 
> Check whether the bridge is attached and only trigger an HPD event if
> it is.
> 
> Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver")
> Signed-off-by: Chen-Yu Tsai <wenst@...omium.org>
> Reviewed-by: Guillaume Ranquet <granquet@...libre.com>

Reviewed-by: Matthias Brugger <matthias.bgg@...il.com>

> ---
> Changes since v1
> - Dropped prerequisite-patch-ids
> - Added Guillaume's Reviewed-by
> 
> This applies on top of mediatek-drm-next.
> 
>   drivers/gpu/drm/mediatek/mtk_dp.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
> index 1f94fcc144d3..a82f53e1a146 100644
> --- a/drivers/gpu/drm/mediatek/mtk_dp.c
> +++ b/drivers/gpu/drm/mediatek/mtk_dp.c
> @@ -1823,7 +1823,8 @@ static irqreturn_t mtk_dp_hpd_event_thread(int hpd, void *dev)
>   	spin_unlock_irqrestore(&mtk_dp->irq_thread_lock, flags);
>   
>   	if (status & MTK_DP_THREAD_CABLE_STATE_CHG) {
> -		drm_helper_hpd_irq_event(mtk_dp->bridge.dev);
> +		if (mtk_dp->bridge.dev)
> +			drm_helper_hpd_irq_event(mtk_dp->bridge.dev);
>   
>   		if (!mtk_dp->train_info.cable_plugged_in) {
>   			mtk_dp_disable_sdp_aui(mtk_dp);