[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231110012914.14884-2-stuart.lee@mediatek.com>
Date: Fri, 10 Nov 2023 09:29:14 +0800
From: Stuart Lee <stuart.lee@...iatek.com>
To: Chun-Kuang Hu <chunkuang.hu@...nel.org>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@...labora.com>
CC: Philipp Zabel <p.zabel@...gutronix.de>,
David Airlie <airlied@...il.com>,
Daniel Vetter <daniel@...ll.ch>,
Matthias Brugger <matthias.bgg@...il.com>,
"Nancy . Lin" <nancy.lin@...iatek.com>,
<dri-devel@...ts.freedesktop.org>,
<linux-mediatek@...ts.infradead.org>,
<linux-kernel@...r.kernel.org>,
<linux-arm-kernel@...ts.infradead.org>,
Stuart Lee <stuart.lee@...iatek.com>,
Lancelot Wu <lancelot.wu@...iatek.com>,
Shawn Sung <shawn.sung@...iatek.com>,
Pablo Sun <pablo.sun@...iatek.com>,
Macpaul Lin <macpaul.lin@...iatek.com>,
<stable@...r.kernel.org>
Subject: [PATCH 1/1] drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get
Add error handling to check NULL input in
mtk_drm_crtc_dma_dev_get function.
While display path is not configured correctly, none of crtc is
established. So the caller of mtk_drm_crtc_dma_dev_get may pass
input parameter *crtc as NULL, Which may cause coredump when
we try to get the container of NULL pointer.
Fixes: cb1d6bcca542 ("drm/mediatek: Add dma dev get function")
Signed-off-by: Stuart Lee <stuart.lee@...iatek.com>
Cc: stable@...r.kernel.org
---
drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
index c277b9fae950..047c9a31d306 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
@@ -921,7 +921,14 @@ static int mtk_drm_crtc_init_comp_planes(struct drm_device *drm_dev,
struct device *mtk_drm_crtc_dma_dev_get(struct drm_crtc *crtc)
{
- struct mtk_drm_crtc *mtk_crtc = to_mtk_crtc(crtc);
+ struct mtk_drm_crtc *mtk_crtc = NULL;
+
+ if (!crtc)
+ return NULL;
+
+ mtk_crtc = to_mtk_crtc(crtc);
+ if (!mtk_crtc)
+ return NULL;
return mtk_crtc->dma_dev;
}
--
2.18.0
Powered by blists - more mailing lists