[PATCH] drm/gma500: fix a possible null pointer dereference

Ma Ke posted 1 patch 1 year, 5 months ago
drivers/gpu/drm/gma500/cdv_intel_lvds.c | 2 ++
1 file changed, 2 insertions(+)
[PATCH] drm/gma500: fix a possible null pointer dereference
Posted by Ma Ke 1 year, 5 months ago
In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate()
is assigned to mode, which will lead to a NULL pointer dereference on
failure of drm_mode_duplicate(). Add a check to avoid npd.

Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 drivers/gpu/drm/gma500/cdv_intel_lvds.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/gma500/cdv_intel_lvds.c b/drivers/gpu/drm/gma500/cdv_intel_lvds.c
index f08a6803dc18..69b8c0fd6063 100644
--- a/drivers/gpu/drm/gma500/cdv_intel_lvds.c
+++ b/drivers/gpu/drm/gma500/cdv_intel_lvds.c
@@ -311,6 +311,8 @@ static int cdv_intel_lvds_get_modes(struct drm_connector *connector)
 	if (mode_dev->panel_fixed_mode != NULL) {
 		struct drm_display_mode *mode =
 		    drm_mode_duplicate(dev, mode_dev->panel_fixed_mode);
+		if (!mode)
+			return -ENOMEM;
 		drm_mode_probed_add(connector, mode);
 		return 1;
 	}
-- 
2.25.1
Re: [PATCH] drm/gma500: fix a possible null pointer dereference
Posted by Markus Elfring 1 year, 5 months ago
> In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate()
> is assigned to mode, which will lead to a NULL pointer dereference on
> failure of drm_mode_duplicate(). Add a check to avoid npd.

1. Can a wording approach (like the following) be a better change description?

   A null pointer is stored in the local variable “mode” after a call
   of the function “drm_mode_duplicate” failed. This pointer was passed to
   a subsequent call of the function “drm_mode_probed_add” where an undesirable
   dereference will be performed then.
   Thus add a corresponding return value check.


2. Would you like to add any tags (like “Fixes”) accordingly?


3. How do you think about to use a summary phrase like “Avoid null pointer dereference
   in cdv_intel_lvds_get_modes()”?

Regards,
Markus