linux-kernel - [PATCH] drm/tegra: Handle EDID allocation failures in tegra_output_connector_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250305154038.2062-1-vulab@iscas.ac.cn>
Date: Wed,  5 Mar 2025 23:40:38 +0800
From: Wentao Liang <vulab@...as.ac.cn>
To: thierry.reding@...il.com,
	mperttunen@...dia.com,
	airlied@...il.com,
	simona@...ll.ch,
	jonathanh@...dia.com
Cc: dri-devel@...ts.freedesktop.org,
	linux-tegra@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Wentao Liang <vulab@...as.ac.cn>,
	stable@...r.kernel.org
Subject: [PATCH] drm/tegra: Handle EDID allocation failures in tegra_output_connector_get_modes()

The return values of `drm_edid_dup()` and `drm_edid_read_ddc()` must
be checked in `tegra_output_connector_get_modes()` to prevent NULL
pointer dereferences. If either function fails, the function should
immediately return 0, indicating that no display modes can be retrieved.

A proper implementation can be found in `vidi_get_modes()`, where the
return values are carefully validated, and the function returns 0 upon
failure.

Fixes: 98365ca74cbf ("drm/tegra: convert to struct drm_edid")
Cc: stable@...r.kernel.org # 6.12+
Signed-off-by: Wentao Liang <vulab@...as.ac.cn>
---
 drivers/gpu/drm/tegra/output.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
index 49e4f63a5550..360c4f83a4f8 100644
--- a/drivers/gpu/drm/tegra/output.c
+++ b/drivers/gpu/drm/tegra/output.c
@@ -39,6 +39,9 @@ int tegra_output_connector_get_modes(struct drm_connector *connector)
 	else if (output->ddc)
 		drm_edid = drm_edid_read_ddc(connector, output->ddc);
 
+	if (!drm_edid)
+		return 0;
+
 	drm_edid_connector_update(connector, drm_edid);
 	cec_notifier_set_phys_addr(output->cec,
 				   connector->display_info.source_physical_address);
-- 
2.42.0.windows.2