drm: Fix an error pointer dereference()
Subsystems (3)
PATCH 1/1 drm: Fix an error pointer dereference()
The drm_mode_create_tile_group() is only called from drm_parse_tiled_block() and the caller expects it to return a NULL on error. In other words, this function should match drm_mode_get_tile_group().
---
I sent a version of this patch last year which updated drm_parse_tiled_block() to check for error pointers. Daniel Vetter said that there was another caller in the msm code, but I don't think there is now.
drivers/gpu/drm/drm_connector.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_connector.c +3 -3
@@ -2077,7 +2077,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);* identifier for the tile group. * * RETURNS: -* new tile group or error. +* new tile group or NULL. */ struct drm_tile_group *drm_mode_create_tile_group (struct drm_device *dev,char topology[8 ])
@@ -2087,7 +2087,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, tg =kzalloc (sizeof (*tg),GFP_KERNEL );if (!tg) -return ERR_PTR (-ENOMEM ); +return NULL ;kref_init (&tg->refcount);memcpy (tg->group_data, topology,8 );
@@ -2099,7 +2099,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, tg->id = ret; }else {kfree (tg); - tg =ERR_PTR (ret); + tg =NULL ; }mutex_unlock (&dev->mode_config.idr_mutex);
Signature · 1 line
2.17.1
Quoted 11 lines · Dan Carpenter
The
drm_mode_create_tile_group()is only called fromdrm_parse_tiled_block()and the caller expects it to return a NULL on error. In other words, this function should matchdrm_mode_get_tile_group().Signed-off-by Dan Carpenter <[email protected]>---
I sent a version of this patch last year which updateddrm_parse_tiled_block()to check for error pointers. Daniel Vetter said that there was another caller in the msm code, but I don't think there is now.
Yup, that msm callsite was removed in
commit 8b03ad30e314691f7bfccc0f9fae0dffd498b667
Author: Chandan Uddaraju <[email protected]> Date: Wed Apr 18 12:45:15 2018 -0700
drm/msm/dsi: Use one connector for dual DSI mode
Thanks for resending your patch, applied for 4.22. -Daniel
Quoted 39 lines
drivers/gpu/drm/drm_connector.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)drivers/gpu/drm/drm_connector.c +3
-3@@ -2077,7 +2077,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);* identifier for the tile group. * * RETURNS: -* new tile group or error. +* new tile group or NULL. */ struct drm_tile_group *drm_mode_create_tile_group (struct drm_device *dev,char topology[8 ])@@ -2087,7 +2087,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, tg =kzalloc (sizeof (*tg),GFP_KERNEL );if (!tg) -return ERR_PTR (-ENOMEM ); +return NULL ;kref_init (&tg->refcount);memcpy (tg->group_data, topology,8 );@@ -2099,7 +2099,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, tg->id = ret; }else {kfree (tg); - tg =ERR_PTR (ret); + tg =NULL ; }mutex_unlock (&dev->mode_config.idr_mutex);Signature · 1 line
2.17.1
Signature · 3 lines
Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch