In amdgpu_connector_add_common_modes(), the return value of drm_cvt_mode()
is assigned to mode, which will lead to a NULL pointer dereference on
failure of drm_cvt_mode(). Add a check to avoid npd.

Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 9caba10315a8..6cf946adb6fe 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -458,6 +458,8 @@ static void amdgpu_connector_add_common_modes(struct drm_encoder *encoder,
 			continue;
 
 		mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, 60, false, false, false);
+		if (!mode)
+			continue;
 		drm_mode_probed_add(connector, mode);
 	}
 }
-- 
2.25.1

Are you planning on submitting a bogus CVE for this patch too?

- Joshie 🐸✨

On June 22, 2024 9:22:19 AM GMT+01:00, Ma Ke <make24@iscas.ac.cn> wrote:
>In amdgpu_connector_add_common_modes(), the return value of drm_cvt_mode()
>is assigned to mode, which will lead to a NULL pointer dereference on
>failure of drm_cvt_mode(). Add a check to avoid npd.
>
>Signed-off-by: Ma Ke <make24@iscas.ac.cn>
>---
> drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
>index 9caba10315a8..6cf946adb6fe 100644
>--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
>+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
>@@ -458,6 +458,8 @@ static void amdgpu_connector_add_common_modes(struct drm_encoder *encoder,
> 			continue;
> 
> 		mode = drm_cvt_mode(dev, common_modes[i].w, common_modes[i].h, 60, false, false, false);
>+		if (!mode)
>+			continue;
> 		drm_mode_probed_add(connector, mode);
> 	}
> }

> In amdgpu_connector_add_common_modes(), the return value of drm_cvt_mode()
> is assigned to mode, which will lead to a NULL pointer dereference on
> failure of drm_cvt_mode(). Add a check to avoid npd.

Can a wording approach (like the following) be a better change description?

   A null pointer is stored in the local variable “mode” after a call
   of the function “drm_cvt_mode” failed. This pointer was passed to
   a subsequent call of the function “drm_mode_probed_add” where an undesirable
   dereference will be performed then.
   Thus add a corresponding return value check.


Would you like to add any tags (like “Fixes”) accordingly?


How do you think about to use a summary phrase like “Avoid null pointer dereference
in amdgpu_connector_add_common_modes()”?

Regards,
Markus