In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
being check if it is valid, which may lead to NULL pointer dereference.
So move the assignment to surface after checking that the omap_lcd is valid.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
---
 hw/display/omap_lcdc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/display/omap_lcdc.c b/hw/display/omap_lcdc.c
index fa4a381db6..2941c5c67c 100644
--- a/hw/display/omap_lcdc.c
+++ b/hw/display/omap_lcdc.c
@@ -78,7 +78,7 @@ static void omap_lcd_interrupts(struct omap_lcd_panel_s *s)
 static void omap_update_display(void *opaque)
 {
     struct omap_lcd_panel_s *omap_lcd = (struct omap_lcd_panel_s *) opaque;
-    DisplaySurface *surface = qemu_console_surface(omap_lcd->con);
+    DisplaySurface *surface;
     draw_line_func draw_line;
     int size, height, first, last;
     int width, linesize, step, bpp, frame_offset;
@@ -89,6 +89,7 @@ static void omap_update_display(void *opaque)
         return;
     }

+    surface = qemu_console_surface(omap_lcd->con);
     frame_offset = 0;
     if (omap_lcd->plm != 2) {
         cpu_physical_memory_read(
-- 
2.19.1

On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
>
> In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
> being check if it is valid, which may lead to NULL pointer dereference.
> So move the assignment to surface after checking that the omap_lcd is valid.
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Alex Chen <alex.chen@huawei.com>
> ---
>  hw/display/omap_lcdc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)



Applied to target-arm.next, thanks.

-- PMM

On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
> >
> > In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
> > being check if it is valid, which may lead to NULL pointer dereference.
> > So move the assignment to surface after checking that the omap_lcd is valid.
> >
> > Reported-by: Euler Robot <euler.robot@huawei.com>
> > Signed-off-by: Alex Chen <alex.chen@huawei.com>
> > ---
> >  hw/display/omap_lcdc.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)

> Applied to target-arm.next, thanks.

Whoops, spoke too soon. This doesn't compile:

../../hw/display/omap_lcdc.c: In function ‘omap_update_display’:
../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used
uninitialized in this function [-Werror=maybe-uninitialized]
         !surface_bits_per_pixel(surface)) {
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


because the early exit check
    if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable ||
        !surface_bits_per_pixel(surface)) {
        return;
    }

uses 'surface' and this patch moves the initialization of that
variable down below its first use.

thanks
-- PMM

On 2020/10/30 22:35, Peter Maydell wrote:
> On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote:
>>
>> On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
>>>
>>> In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
>>> being check if it is valid, which may lead to NULL pointer dereference.
>>> So move the assignment to surface after checking that the omap_lcd is valid.
>>>
>>> Reported-by: Euler Robot <euler.robot@huawei.com>
>>> Signed-off-by: Alex Chen <alex.chen@huawei.com>
>>> ---
>>>  hw/display/omap_lcdc.c | 3 ++-
>>>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
>> Applied to target-arm.next, thanks.
> 
> Whoops, spoke too soon. This doesn't compile:
> 
> ../../hw/display/omap_lcdc.c: In function ‘omap_update_display’:
> ../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used
> uninitialized in this function [-Werror=maybe-uninitialized]
>          !surface_bits_per_pixel(surface)) {
>           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> 
> because the early exit check
>     if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable ||
>         !surface_bits_per_pixel(surface)) {
>         return;
>     }
> 
> uses 'surface' and this patch moves the initialization of that
> variable down below its first use.
> 

Oh, I apologize for this compilation error, I will fix it in my patch v2.

Thanks,
Alex