linux-kernel - Re: [PATCH 01/39] drm/atomic: Make drm_atomic_get_connector

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BBD9E72B-B1B6-4072-A465-68204879684C@oss.qualcomm.com>
Date: Wed, 27 Aug 2025 20:40:47 +0300
From: Dmitry Baryshkov <dmitry.baryshkov@....qualcomm.com>
To: Maxime Ripard <mripard@...nel.org>,
        Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
        Louis Chauvet <louis.chauvet@...tlin.com>,
        Haneen Mohammed <hamohammed.sa@...il.com>,
        Melissa Wen <melissa.srw@...il.com>, Jyri Sarha <jyri.sarha@....fi>,
        Tomi Valkeinen <tomi.valkeinen@...asonboard.com>,
        Paul Cercueil <paul@...pouillou.net>,
        Liviu Dudau <liviu.dudau@....com>,
        Russell King <linux@...linux.org.uk>,
        Manikandan Muralidharan <manikandan.m@...rochip.com>,
        Dharma Balasubiramani <dharma.b@...rochip.com>,
        Nicolas Ferre <nicolas.ferre@...rochip.com>,
        Alexandre Belloni <alexandre.belloni@...tlin.com>,
        Claudiu Beznea <claudiu.beznea@...on.dev>,
        Inki Dae <inki.dae@...sung.com>,
        Seung-Woo Kim <sw0312.kim@...sung.com>,
        Kyungmin Park <kyungmin.park@...sung.com>,
        Krzysztof Kozlowski <krzk@...nel.org>,
        Alim Akhtar <alim.akhtar@...sung.com>, Liu Ying <victor.liu@....com>,
        Shawn Guo <shawnguo@...nel.org>, Sascha Hauer <s.hauer@...gutronix.de>,
        Pengutronix Kernel Team <kernel@...gutronix.de>,
        Fabio Estevam <festevam@...il.com>,
        Laurentiu Palcu <laurentiu.palcu@....nxp.com>,
        Lucas Stach <l.stach@...gutronix.de>,
        Philipp Zabel <p.zabel@...gutronix.de>,
        Anitha Chrisanthus <anitha.chrisanthus@...el.com>,
        Edmund Dea <edmund.j.dea@...el.com>,
        Paul Kocialkowski <paulk@...-base.io>,
        Sui Jingfeng <suijingfeng@...ngson.cn>,
        Chun-Kuang Hu <chunkuang.hu@...nel.org>,
        Matthias Brugger <matthias.bgg@...il.com>,
        AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
        Rob Clark <robin.clark@....qualcomm.com>,
        Dmitry Baryshkov <lumag@...nel.org>,
        Abhinav Kumar <abhinav.kumar@...ux.dev>,
        Jessica Zhang <jessica.zhang@....qualcomm.com>,
        Sean Paul <sean@...rly.run>,
        Marijn Suijten <marijn.suijten@...ainline.org>,
        Sandy Huang <hjc@...k-chips.com>,
        Heiko Stübner <heiko@...ech.de>,
        Andy Yan <andy.yan@...k-chips.com>, Chen-Yu Tsai <wens@...e.org>,
        Jernej Skrabec <jernej.skrabec@...il.com>,
        Samuel Holland <samuel@...lland.org>,
        Thierry Reding <thierry.reding@...il.com>,
        Mikko Perttunen <mperttunen@...dia.com>,
        Jonathan Hunter <jonathanh@...dia.com>,
        Hans de Goede <hansg@...nel.org>,
        Dave Stevenson <dave.stevenson@...pberrypi.com>,
        Maíra Canal <mcanal@...lia.com>,
        Raspberry Pi Kernel Maintenance <kernel-list@...pberrypi.com>
CC: dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        linux-mips@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-samsung-soc@...r.kernel.org, imx@...ts.linux.dev,
        linux-mediatek@...ts.infradead.org, linux-arm-msm@...r.kernel.org,
        freedreno@...ts.freedesktop.org, linux-rockchip@...ts.infradead.org,
        linux-sunxi@...ts.linux.dev, linux-tegra@...r.kernel.org
Subject: Re: [PATCH 01/39] drm/atomic: Make drm_atomic_get_connector_state() early return consistent

On 25 August 2025 16.43.06 EEST, Maxime Ripard <mripard@...nel.org> wrote:
>The drm_atomic_get_connector_state() tries to lookup if a connector
>state was already allocated in the global state to return early if it
>was the case. drm_atomic_get_plane_state() and
>drm_atomic_get_crtc_state() behave similarly.
>
>However, and unlike the other two, drm_atomic_get_connector_state() will
>do that lookup after having called drm_modeset_lock(), when the others
>will do it before.
>
>Let's move the early return before the lock to make it consistent.
>
>Signed-off-by: Maxime Ripard <mripard@...nel.org>
>---
> drivers/gpu/drm/drm_atomic.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
>index cd15cf52f0c9144711da5879da57884674aea9e4..fe21f154e0fa030f85fb3d6d35e2684adcf36e26 100644
>--- a/drivers/gpu/drm/drm_atomic.c
>+++ b/drivers/gpu/drm/drm_atomic.c
>@@ -1128,10 +1128,13 @@ drm_atomic_get_connector_state(struct drm_atomic_state *state,
> 	struct drm_mode_config *config = &connector->dev->mode_config;
> 	struct drm_connector_state *connector_state;
> 
> 	WARN_ON(!state->acquire_ctx);
> 
>+	if (state->connectors[index].state)
>+		return state->connectors[index].state;

Unlike other DRM objects, connectors are dynamic. There is no guarantee that at this point this array entry exists and it's valid. You might be tampering with the unallocated memory.

>+
> 	ret = drm_modeset_lock(&config->connection_mutex, state->acquire_ctx);
> 	if (ret)
> 		return ERR_PTR(ret);
> 
> 	index = drm_connector_index(connector);
>@@ -1150,13 +1153,10 @@ drm_atomic_get_connector_state(struct drm_atomic_state *state,
> 		       sizeof(*state->connectors) * (alloc - state->num_connector));
> 
> 		state->num_connector = alloc;
> 	}
> 
>-	if (state->connectors[index].state)
>-		return state->connectors[index].state;
>-
> 	connector_state = connector->funcs->atomic_duplicate_state(connector);
> 	if (!connector_state)
> 		return ERR_PTR(-ENOMEM);
> 
> 	drm_connector_get(connector);
>


With best wishes 
Dmitry