Skip to contentSkip to conversation

drm: Fix an error pointer dereference()

PATCH In review Dan Carpenter 2 participants 2 messages Dec 17, 2018

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 drm: Fix an error pointer dereference()

The drm_mode_create_tile_group() is only called from drm_parse_tiled_block() and the caller expects it to return a NULL on error. In other words, this function should match drm_mode_get_tile_group().

---
I sent a version of this patch last year which updated drm_parse_tiled_block() to check for error pointers. Daniel Vetter said that there was another caller in the msm code, but I don't think there is now.

 drivers/gpu/drm/drm_connector.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_connector.c +3 -3
index da8ae80c2750..3971174f6aed 100644
@@ -2077,7 +2077,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);
  * identifier for the tile group.
  *
  * RETURNS:
- * new tile group or error.
+ * new tile group or NULL.
  */
 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
 						  char topology[8])
@@ -2087,7 +2087,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
 
 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
 	if (!tg)
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 
 	kref_init(&tg->refcount);
 	memcpy(tg->group_data, topology, 8);
@@ -2099,7 +2099,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
 		tg->id = ret;
 	} else {
 		kfree(tg);
-		tg = ERR_PTR(ret);
+		tg = NULL;
 	}
 
 	mutex_unlock(&dev->mode_config.idr_mutex);
Signature · 1 line
2.17.1
#1 lore raw
Quoted 11 lines · Dan Carpenter

The drm_mode_create_tile_group() is only called from drm_parse_tiled_block() and the caller expects it to return a NULL on error. In other words, this function should match drm_mode_get_tile_group().

---
I sent a version of this patch last year which updated drm_parse_tiled_block() to check for error pointers. Daniel Vetter said that there was another caller in the msm code, but I don't think there is now.

Yup, that msm callsite was removed in

commit 8b03ad30e314691f7bfccc0f9fae0dffd498b667

Author: Chandan Uddaraju <[email protected]>
Date:   Wed Apr 18 12:45:15 2018 -0700

drm/msm/dsi: Use one connector for dual DSI mode

Thanks for resending your patch, applied for 4.22. -Daniel

Quoted 39 lines

 drivers/gpu/drm/drm_connector.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/drm_connector.c +3 -3
index da8ae80c2750..3971174f6aed 100644
@@ -2077,7 +2077,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group);
  * identifier for the tile group.
  *
  * RETURNS:
- * new tile group or error.
+ * new tile group or NULL.
  */
 struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
 						  char topology[8])
@@ -2087,7 +2087,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
 
 	tg = kzalloc(sizeof(*tg), GFP_KERNEL);
 	if (!tg)
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 
 	kref_init(&tg->refcount);
 	memcpy(tg->group_data, topology, 8);
@@ -2099,7 +2099,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev,
 		tg->id = ret;
 	} else {
 		kfree(tg);
-		tg = ERR_PTR(ret);
+		tg = NULL;
 	}
 
 	mutex_unlock(&dev->mode_config.idr_mutex);
Signature · 1 line
2.17.1
Signature · 3 lines
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch