linux-kernel - Re: [RESEND PATCH] drm/mediatek: Add error handling for old state CRTC in atomic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bba7ff19-8ce0-406d-b2a1-4489858fdb33@collabora.com>
Date: Tue, 29 Jul 2025 12:26:32 +0200
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
To: Jason-JH Lin <jason-jh.lin@...iatek.com>,
 Chun-Kuang Hu <chunkuang.hu@...nel.org>, David Airlie <airlied@...il.com>
Cc: Philipp Zabel <p.zabel@...gutronix.de>, Daniel Vetter <daniel@...ll.ch>,
 Matthias Brugger <matthias.bgg@...il.com>, Nancy Lin
 <nancy.lin@...iatek.com>, Singo Chang <singo.chang@...iatek.com>,
 Paul-PL Chen <paul-pl.chen@...iatek.com>,
 Yongqiang Niu <yongqiang.niu@...iatek.com>,
 Zhenxing Qin <zhenxing.qin@...iatek.com>,
 Xiandong Wang <xiandong.wang@...iatek.com>,
 Sirius Wang <sirius.wang@...iatek.com>,
 Xavier Chang <xavier.chang@...iatek.com>,
 Jarried Lin <jarried.lin@...iatek.com>, Fei Shao <fshao@...omium.org>,
 Chen-yu Tsai <wenst@...omium.org>, linux-kernel@...r.kernel.org,
 linux-mediatek@...ts.infradead.org, linux-arm-kernel@...ts.infradead.org,
 Project_Global_Chrome_Upstream_Group@...iatek.com
Subject: Re: [RESEND PATCH] drm/mediatek: Add error handling for old state
 CRTC in atomic_disable

Il 28/07/25 04:48, Jason-JH Lin ha scritto:
> Introduce error handling to address an issue where, after a hotplug
> event, the cursor continues to update. This situation can lead to a
> kernel panic due to accessing the NULL `old_state->crtc`.
> 
> E,g.
> Unable to handle kernel NULL pointer dereference at virtual address
> Call trace:
>   mtk_crtc_plane_disable+0x24/0x140
>   mtk_plane_atomic_update+0x8c/0xa8
>   drm_atomic_helper_commit_planes+0x114/0x2c8
>   drm_atomic_helper_commit_tail_rpm+0x4c/0x158
>   commit_tail+0xa0/0x168
>   drm_atomic_helper_commit+0x110/0x120
>   drm_atomic_commit+0x8c/0xe0
>   drm_atomic_helper_update_plane+0xd4/0x128
>   __setplane_atomic+0xcc/0x110
>   drm_mode_cursor_common+0x250/0x440
>   drm_mode_cursor_ioctl+0x44/0x70
>   drm_ioctl+0x264/0x5d8
>   __arm64_sys_ioctl+0xd8/0x510
>   invoke_syscall+0x6c/0xe0
>   do_el0_svc+0x68/0xe8
>   el0_svc+0x34/0x60
>   el0t_64_sync_handler+0x1c/0xf8
>   el0t_64_sync+0x180/0x188
> 
> Adding NULL pointer checks to ensure stability by preventing operations
> on an invalid CRTC state.
> 
> Fixes: d208261e9f7c ("drm/mediatek: Add wait_event_timeout when disabling plane")
> Signed-off-by: Jason-JH Lin <jason-jh.lin@...iatek.com>

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>