drivers/gpu/drm/panel/panel-himax-hx83102.c | 4 ++++ 1 file changed, 4 insertions(+)
From: hanchunchao <hanchunchao@inspur.com>
In hx83102_get_modes(), the return value of drm_mode_duplicate() is
assigned to mode, which will lead to a possible NULL pointer dereference
on failure of drm_mode_duplicate(). Add a check to avoid npd.
Signed-off-by: hanchunchao <hanchunchao@inspur.com>
---
drivers/gpu/drm/panel/panel-himax-hx83102.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/panel/panel-himax-hx83102.c b/drivers/gpu/drm/panel/panel-himax-hx83102.c
index 6e4b7e4644ce..048c2c5897ae 100644
--- a/drivers/gpu/drm/panel/panel-himax-hx83102.c
+++ b/drivers/gpu/drm/panel/panel-himax-hx83102.c
@@ -565,6 +565,10 @@ static int hx83102_get_modes(struct drm_panel *panel,
struct drm_display_mode *mode;
mode = drm_mode_duplicate(connector->dev, m);
+ if (!mode) {
+ dev_err(connector->dev, "bad mode or failed to add mode\n");
+ return -EINVAL;
+ }
mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
drm_mode_set_name(mode);
--
2.39.3Hi Charles,
kernel test robot noticed the following build errors:
[auto build test ERROR on linus/master]
[also build test ERROR on v6.11-rc4 next-20240821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Charles-Han/drm-panel-hx83102-fix-null-pointer-dereference-in-hx83102_get_modes/20240821-191703
base: linus/master
patch link: https://lore.kernel.org/r/20240821095039.15282-1-hanchunchao%40inspur.com
patch subject: [PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes
config: s390-allmodconfig (https://download.01.org/0day-ci/archive/20240822/202408221127.2O9Pauzi-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 26670e7fa4f032a019d23d56c6a02926e854e8af)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240822/202408221127.2O9Pauzi-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202408221127.2O9Pauzi-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from drivers/gpu/drm/panel/panel-himax-hx83102.c:12:
In file included from include/linux/module.h:19:
In file included from include/linux/elf.h:6:
In file included from arch/s390/include/asm/elf.h:181:
In file included from arch/s390/include/asm/mmu_context.h:11:
In file included from arch/s390/include/asm/pgalloc.h:18:
In file included from include/linux/mm.h:2228:
include/linux/vmstat.h:503:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
503 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
504 | item];
| ~~~~
include/linux/vmstat.h:510:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
510 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
511 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
include/linux/vmstat.h:517:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
517 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
| ~~~~~~~~~~~ ^ ~~~
include/linux/vmstat.h:523:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
523 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
524 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
>> drivers/gpu/drm/panel/panel-himax-hx83102.c:569:11: error: incompatible pointer types passing 'struct drm_device *' to parameter of type 'const struct device *' [-Werror,-Wincompatible-pointer-types]
569 | dev_err(connector->dev, "bad mode or failed to add mode\n");
| ^~~~~~~~~~~~~~
include/linux/dev_printk.h:154:44: note: expanded from macro 'dev_err'
154 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~
include/linux/dev_printk.h:110:11: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
include/linux/dev_printk.h:50:36: note: passing argument to parameter 'dev' here
50 | void _dev_err(const struct device *dev, const char *fmt, ...);
| ^
4 warnings and 1 error generated.
vim +569 drivers/gpu/drm/panel/panel-himax-hx83102.c
559
560 static int hx83102_get_modes(struct drm_panel *panel,
561 struct drm_connector *connector)
562 {
563 struct hx83102 *ctx = panel_to_hx83102(panel);
564 const struct drm_display_mode *m = ctx->desc->modes;
565 struct drm_display_mode *mode;
566
567 mode = drm_mode_duplicate(connector->dev, m);
568 if (!mode) {
> 569 dev_err(connector->dev, "bad mode or failed to add mode\n");
570 return -EINVAL;
571 }
572
573 mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
574 drm_mode_set_name(mode);
575 drm_mode_probed_add(connector, mode);
576
577 connector->display_info.width_mm = ctx->desc->size.width_mm;
578 connector->display_info.height_mm = ctx->desc->size.height_mm;
579 connector->display_info.bpc = 8;
580
581 return 1;
582 }
583
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Charles,
kernel test robot noticed the following build errors:
[auto build test ERROR on linus/master]
[also build test ERROR on v6.11-rc4 next-20240821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Charles-Han/drm-panel-hx83102-fix-null-pointer-dereference-in-hx83102_get_modes/20240821-191703
base: linus/master
patch link: https://lore.kernel.org/r/20240821095039.15282-1-hanchunchao%40inspur.com
patch subject: [PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes
config: s390-allyesconfig (https://download.01.org/0day-ci/archive/20240822/202408221044.vVHNGMnS-lkp@intel.com/config)
compiler: s390-linux-gcc (GCC) 14.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240822/202408221044.vVHNGMnS-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202408221044.vVHNGMnS-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from include/linux/device.h:15,
from include/linux/blk_types.h:11,
from include/linux/writeback.h:13,
from include/linux/memcontrol.h:23,
from include/linux/swap.h:9,
from include/linux/suspend.h:5,
from include/linux/regulator/consumer.h:35,
from drivers/gpu/drm/panel/panel-himax-hx83102.c:14:
drivers/gpu/drm/panel/panel-himax-hx83102.c: In function 'hx83102_get_modes':
>> drivers/gpu/drm/panel/panel-himax-hx83102.c:569:34: error: passing argument 1 of '_dev_err' from incompatible pointer type [-Wincompatible-pointer-types]
569 | dev_err(connector->dev, "bad mode or failed to add mode\n");
| ~~~~~~~~~^~~~~
| |
| struct drm_device *
include/linux/dev_printk.h:110:25: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
drivers/gpu/drm/panel/panel-himax-hx83102.c:569:17: note: in expansion of macro 'dev_err'
569 | dev_err(connector->dev, "bad mode or failed to add mode\n");
| ^~~~~~~
include/linux/dev_printk.h:50:36: note: expected 'const struct device *' but argument is of type 'struct drm_device *'
50 | void _dev_err(const struct device *dev, const char *fmt, ...);
| ~~~~~~~~~~~~~~~~~~~~~^~~
vim +/_dev_err +569 drivers/gpu/drm/panel/panel-himax-hx83102.c
559
560 static int hx83102_get_modes(struct drm_panel *panel,
561 struct drm_connector *connector)
562 {
563 struct hx83102 *ctx = panel_to_hx83102(panel);
564 const struct drm_display_mode *m = ctx->desc->modes;
565 struct drm_display_mode *mode;
566
567 mode = drm_mode_duplicate(connector->dev, m);
568 if (!mode) {
> 569 dev_err(connector->dev, "bad mode or failed to add mode\n");
570 return -EINVAL;
571 }
572
573 mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
574 drm_mode_set_name(mode);
575 drm_mode_probed_add(connector, mode);
576
577 connector->display_info.width_mm = ctx->desc->size.width_mm;
578 connector->display_info.height_mm = ctx->desc->size.height_mm;
579 connector->display_info.bpc = 8;
580
581 return 1;
582 }
583
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
On Wed, Aug 21, 2024 at 05:50:39PM +0800, Charles Han wrote: > From: hanchunchao <hanchunchao@inspur.com> Nit, this should be your name, not your email alias here, like you have it on your "From" line. > In hx83102_get_modes(), the return value of drm_mode_duplicate() is > assigned to mode, which will lead to a possible NULL pointer dereference > on failure of drm_mode_duplicate(). Add a check to avoid npd. > > Signed-off-by: hanchunchao <hanchunchao@inspur.com> Same here. What commit id does this fix? Shouldn't you also cc: stable to get it backported? And there's no need to cc: security@kernel.org, as this is a public issue and you have a patch for it. thanks, greg k-h
© 2016 - 2026 Red Hat, Inc.