linux-kernel - Re: [PATCH RESEND] drm/sti: avoid potential dereference of error pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20240913091900.2025122-1-make24@iscas.ac.cn>
Date: Fri, 13 Sep 2024 17:19:00 +0800
From: Ma Ke <make24@...as.ac.cn>
To: alain.volmat@...s.st.com
Cc: airlied@...il.com,
	akpm@...ux-foundation.org,
	daniel@...ll.ch,
	dri-devel@...ts.freedesktop.org,
	laurent.pinchart@...asonboard.com,
	linux-kernel@...r.kernel.org,
	maarten.lankhorst@...ux.intel.com,
	make24@...as.ac.cn,
	mripard@...nel.org,
	stable@...r.kernel.org,
	tzimmermann@...e.de
Subject: Re: [PATCH RESEND] drm/sti: avoid potential dereference of error pointers

Alain Volmat<alain.volmat@...s.st.com> wrote:
> Hi,
> 
> I probably went a bit fast on the commit message.  It seems to me that
> the Fixes line would be probably better with below one instead.
> 
> Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
> 
> The same fix is actually necessary for all planes (cursor / gdp / hqvdp),
> which is related to the same original commit.  Hence sti_cursor/sti_gdp
> and sti_hqvdp.
> 
> Would you be ok to have those 3 fixes within a commit ?
> 
> Regards,
> Alain
> 
> On Tue, Sep 10, 2024 at 07:25:43PM +0200, Alain Volmat wrote:
> > Hi,
> > 
> > Thanks for your patch.
> > 
> > Acked-by: Alain Volmat <alain.volmat@...s.st.com>
> > 
> > Regards,
> > Alain
> > 
> > On Mon, Aug 26, 2024 at 01:26:52PM +0800, Ma Ke wrote:
> > > The return value of drm_atomic_get_crtc_state() needs to be
> > > checked. To avoid use of error pointer 'crtc_state' in case
> > > of the failure.
> > > 
> > > Cc: stable@...r.kernel.org
> > > Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check")
> > > 
> > > Signed-off-by: Ma Ke <make24@...as.ac.cn>
> > > ---
> > >  drivers/gpu/drm/sti/sti_cursor.c | 2 ++
> > >  1 file changed, 2 insertions(+)
> > > 
> > > diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
> > > index db0a1eb53532..e460f5ba2d87 100644
> > > --- a/drivers/gpu/drm/sti/sti_cursor.c
> > > +++ b/drivers/gpu/drm/sti/sti_cursor.c
> > > @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
> > >  		return 0;
> > >  
> > >  	crtc_state = drm_atomic_get_crtc_state(state, crtc);
> > > +	if (IS_ERR(crtc_state))
> > > +		return PTR_ERR(crtc_state);
> > >  	mode = &crtc_state->mode;
> > >  	dst_x = new_plane_state->crtc_x;
> > >  	dst_y = new_plane_state->crtc_y;
> > > -- 
> > > 2.25.1
> > > 
Hi，

I appreciate your guidance regarding the modification of the Fixes tag. As 
your observation, I have also identified the additional instance
(sti_hqvdp_atomic_check) where a similar issue exists, necessitating the 
same patch. I have recognized the problem and was in the process of 
reporting it. To prevent any confusion and ensure accurate reporting, I 
have updated the patch already submitted as patch v2. The issue in 
sti_hqvdp_atomic_check has also been reported, and I kindly request you to 
review it.(I am not very familiar with how to combine the reporting of 
vulnerabilities in multiple functions, so to avoid unnecessary errors or 
confusion, I reported them one by one. Hope for your understanding.) Thank 
you for your prompt response. Your assistance is invaluable to me.

Best regards,
Ma Ke