drm/meson: fix NULL pointer dereference in meson_drv_bind_master()
Subsystems (5)
PATCH 1/1 drm/meson: fix NULL pointer dereference in meson_drv_bind_master()
If the allocation of priv fails, meson_drv_bind_master() jumps to the free_drm label, which calls meson_encoder_{dsi,hdmi,cvbs}_remove() with a NULL priv. These functions dereference priv, so the error path oopses instead of returning -ENOMEM.
Only the drm device has been allocated at that point, so put it and return directly.
Found by Linux Verification Center (linuxtesting.org) with SVACE. Compile tested only.
--- drivers/gpu/drm/meson/meson_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/meson/meson_drv.c +2 -2
@@ -204,8 +204,8 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) priv =devm_kzalloc_obj (dev, *priv);if (!priv) { - ret = -ENOMEM ; - goto free_drm; +drm_dev_put (drm); +return -ENOMEM ; } drm->dev_private = priv; priv->drm = drm;
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
Signature · 1 line
2.39.5
[email protected]
AI reviewThank you for your contribution! Sashiko AI review found no new issues in this patch, but noticed 1 related pre-existing issue it does not introduce: - [Critical] drm/meson: missing…
Thank you for your contribution! Sashiko AI review found no new issues in this patch, but noticed 1 related pre-existing issue it does not introduce:
- [Critical] drm/meson: missing drm_kms_helper_poll_fini() on error in meson_drv_bind_master() [1]
--
commit 79a6a19243f321e0c18a04ea82e4aefcdcacddf4
Author: Rand Deeb <[email protected]>
drm/meson: fix NULL pointer dereference in meson_drv_bind_master()
This commit avoids jumping to free_drm when allocating priv fails in meson_drv_bind_master(), directly putting the drm device and returning -ENOMEM so encoder removal helpers are not called with a NULL priv.
Quoted 5 lines
drivers/gpu/drm/meson/meson_drv.c +0
-0
drivers/gpu/drm/meson/meson_drv.c static int meson_drv_bind_master(struct device *dev, bool has_components) · line 211
Quoted 10 lines
drivers/gpu/drm/meson/meson_drv.c +2
-2@@ -204,8 +204,8 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) priv =devm_kzalloc_obj (dev, *priv);if (!priv) { - ret = -ENOMEM ; - goto free_drm; +drm_dev_put (drm); +return -ENOMEM ; } drm->dev_private = priv; priv->drm = drm;
[Severity: Critical]
This problem wasn't introduced by this patch, but can a failure in drm_dev_register() cause a use-after-free on drm->mode_config.output_poll_work [1]?
drivers/gpu/drm/meson/meson_drv.c:meson_drv_bind_master() {
...
drm_kms_helper_poll_init(drm);
platform_set_drvdata(pdev, priv);
ret = drm_dev_register(drm, 0);
if (ret)
goto uninstall_irq;
...
uninstall_irq:
free_irq(priv->vsync_irq, drm);
}When drm_dev_register() fails, jumping to uninstall_irq reaches drm_dev_put() without calling drm_kms_helper_poll_fini(), leaving output_poll_work active after the drm_device is freed.
[1] https://sashiko.dev/#/bug/linux-e1c69353-dace-476d-bef2-4ab1c205215c
Signature · 6 lines
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1 _______________________________________________ linux-amlogic mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-amlogic