linux-kernel - Re: [PATCH] drm/mediatek: Initialize pointer in mtk_drm_of_ddp_path_build

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3021edf83e5ad32c1ebe9ea711127956aedc211c.camel@mediatek.com>
Date: Thu, 28 Nov 2024 05:45:11 +0000
From: CK Hu (胡俊光) <ck.hu@...iatek.com>
To: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
	"chunkuang.hu@...nel.org" <chunkuang.hu@...nel.org>
CC: "linux-mediatek@...ts.infradead.org" <linux-mediatek@...ts.infradead.org>,
	"sui.jingfeng@...ux.dev" <sui.jingfeng@...ux.dev>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"simona@...ll.ch" <simona@...ll.ch>, "kernel@...labora.com"
	<kernel@...labora.com>, "p.zabel@...gutronix.de" <p.zabel@...gutronix.de>,
	"dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
	Alexandre Mergnat <amergnat@...libre.com>, "airlied@...il.com"
	<airlied@...il.com>, "linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "matthias.bgg@...il.com"
	<matthias.bgg@...il.com>, "dan.carpenter@...aro.org"
	<dan.carpenter@...aro.org>
Subject: Re: [PATCH] drm/mediatek: Initialize pointer in
 mtk_drm_of_ddp_path_build_one()

Hi, Angelo:

On Tue, 2024-11-12 at 11:50 +0100, AngeloGioacchino Del Regno wrote:
> External email : Please do not click links or open attachments until you have verified the sender or the content.
> 
> 
> The struct device_node *next pointer is not initialized, and it is
> used in an error path in which it may have never been modified by
> function mtk_drm_of_get_ddp_ep_cid().
> 
> Since the error path is relying on that pointer being NULL for the
> OVL Adaptor and/or invalid component check and since said pointer
> is being used in prints for %pOF, in the case that it points to a
> bogus address, the print may cause a KP.
> 
> To resolve that, initialize the *next pointer to NULL before usage.

Reviewed-by: CK Hu <ck.hu@...iatek.com>

> 
> Fixes: 4c932840db1d ("drm/mediatek: Implement OF graphs support for display paths")
> Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
> ---
>  drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> index 9a8ef8558da9..bc06c664e80f 100644
> --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
> @@ -900,7 +900,7 @@ static int mtk_drm_of_ddp_path_build_one(struct device *dev, enum mtk_crtc_path
>                                          const unsigned int **out_path,
>                                          unsigned int *out_path_len)
>  {
> -       struct device_node *next, *prev, *vdo = dev->parent->of_node;
> +       struct device_node *next = NULL, *prev, *vdo = dev->parent->of_node;
>         unsigned int temp_path[DDP_COMPONENT_DRM_ID_MAX] = { 0 };
>         unsigned int *final_ddp_path;
>         unsigned short int idx = 0;
> --
> 2.47.0
>