linux-kernel - Re: [PATCH] drm/crtc: Fix uninit-value bug in drm_mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 08 Dec 2023 10:23:48 +0100
From:   Maxime Ripard <mripard@...nel.org>
To:     airlied@...il.com, daniel@...ll.ch,
        dri-devel@...ts.freedesktop.org, ivan.orlov0322@...il.com,
        maarten.lankhorst@...ux.intel.com, skhan@...uxfoundation.org,
        tzimmermann@...e.de, Ziqi Zhao <astrajoan@...oo.com>
Cc:     syzkaller-bugs@...glegroups.com, linux-kernel@...r.kernel.org,
        christian.koenig@....com, linaro-mm-sig@...ts.linaro.org,
        glider@...gle.com,
        syzbot+4fad2e57beb6397ab2fc@...kaller.appspotmail.com,
        sumit.semwal@...aro.org, linux-media@...r.kernel.org
Subject: Re: [PATCH] drm/crtc: Fix uninit-value bug in drm_mode_setcrtc

On Fri, 21 Jul 2023 09:14:46 -0700, Ziqi Zhao wrote:
> The connector_set contains uninitialized values when allocated with
> kmalloc_array. However, in the "out" branch, the logic assumes that any
> element in connector_set would be equal to NULL if failed to
> initialize, which causes the bug reported by Syzbot. The fix is to use
> an extra variable to keep track of how many connectors are initialized
> indeed, and use that variable to decrease any refcounts in the "out"
> branch.
> 
> [...]

Applied to drm/drm-misc (drm-misc-fixes).

Thanks!
Maxime