[v1] drm/sti: avoid potential dereference of error pointers

[PATCH RESEND] drm/sti: avoid potential dereference of error pointers

Posted by Ma Ke 1 year, 3 months ago

The return value of drm_atomic_get_crtc_state() needs to be
checked. To avoid use of error pointer 'crtc_state' in case
of the failure.

Cc: stable@vger.kernel.org
Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check")

Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 drivers/gpu/drm/sti/sti_cursor.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
index db0a1eb53532..e460f5ba2d87 100644
--- a/drivers/gpu/drm/sti/sti_cursor.c
+++ b/drivers/gpu/drm/sti/sti_cursor.c
@@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
 		return 0;
 
 	crtc_state = drm_atomic_get_crtc_state(state, crtc);
+	if (IS_ERR(crtc_state))
+		return PTR_ERR(crtc_state);
 	mode = &crtc_state->mode;
 	dst_x = new_plane_state->crtc_x;
 	dst_y = new_plane_state->crtc_y;
-- 
2.25.1

Re: [PATCH RESEND] drm/sti: avoid potential dereference of error pointers

Posted by Alain Volmat 1 year, 3 months ago

Hi,

Thanks for your patch.

Acked-by: Alain Volmat <alain.volmat@foss.st.com>

Regards,
Alain

On Mon, Aug 26, 2024 at 01:26:52PM +0800, Ma Ke wrote:
> The return value of drm_atomic_get_crtc_state() needs to be
> checked. To avoid use of error pointer 'crtc_state' in case
> of the failure.
> 
> Cc: stable@vger.kernel.org
> Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check")
> 
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> ---
>  drivers/gpu/drm/sti/sti_cursor.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
> index db0a1eb53532..e460f5ba2d87 100644
> --- a/drivers/gpu/drm/sti/sti_cursor.c
> +++ b/drivers/gpu/drm/sti/sti_cursor.c
> @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
>  		return 0;
>  
>  	crtc_state = drm_atomic_get_crtc_state(state, crtc);
> +	if (IS_ERR(crtc_state))
> +		return PTR_ERR(crtc_state);
>  	mode = &crtc_state->mode;
>  	dst_x = new_plane_state->crtc_x;
>  	dst_y = new_plane_state->crtc_y;
> -- 
> 2.25.1
>

Re: [PATCH RESEND] drm/sti: avoid potential dereference of error pointers

Posted by Alain Volmat 1 year, 3 months ago

Hi,

I probably went a bit fast on the commit message.  It seems to me that
the Fixes line would be probably better with below one instead.

Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")

The same fix is actually necessary for all planes (cursor / gdp / hqvdp),
which is related to the same original commit.  Hence sti_cursor/sti_gdp
and sti_hqvdp.

Would you be ok to have those 3 fixes within a commit ?

Regards,
Alain

On Tue, Sep 10, 2024 at 07:25:43PM +0200, Alain Volmat wrote:
> Hi,
> 
> Thanks for your patch.
> 
> Acked-by: Alain Volmat <alain.volmat@foss.st.com>
> 
> Regards,
> Alain
> 
> On Mon, Aug 26, 2024 at 01:26:52PM +0800, Ma Ke wrote:
> > The return value of drm_atomic_get_crtc_state() needs to be
> > checked. To avoid use of error pointer 'crtc_state' in case
> > of the failure.
> > 
> > Cc: stable@vger.kernel.org
> > Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check")
> > 
> > Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> > ---
> >  drivers/gpu/drm/sti/sti_cursor.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
> > index db0a1eb53532..e460f5ba2d87 100644
> > --- a/drivers/gpu/drm/sti/sti_cursor.c
> > +++ b/drivers/gpu/drm/sti/sti_cursor.c
> > @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
> >  		return 0;
> >  
> >  	crtc_state = drm_atomic_get_crtc_state(state, crtc);
> > +	if (IS_ERR(crtc_state))
> > +		return PTR_ERR(crtc_state);
> >  	mode = &crtc_state->mode;
> >  	dst_x = new_plane_state->crtc_x;
> >  	dst_y = new_plane_state->crtc_y;
> > -- 
> > 2.25.1
> >

Re: [PATCH RESEND] drm/sti: avoid potential dereference of error pointers

Posted by Ma Ke 1 year, 3 months ago

Alain Volmat<alain.volmat@foss.st.com> wrote:
> Hi,
> 
> I probably went a bit fast on the commit message.  It seems to me that
> the Fixes line would be probably better with below one instead.
> 
> Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
> 
> The same fix is actually necessary for all planes (cursor / gdp / hqvdp),
> which is related to the same original commit.  Hence sti_cursor/sti_gdp
> and sti_hqvdp.
> 
> Would you be ok to have those 3 fixes within a commit ?
> 
> Regards,
> Alain
> 
> On Tue, Sep 10, 2024 at 07:25:43PM +0200, Alain Volmat wrote:
> > Hi,
> > 
> > Thanks for your patch.
> > 
> > Acked-by: Alain Volmat <alain.volmat@foss.st.com>
> > 
> > Regards,
> > Alain
> > 
> > On Mon, Aug 26, 2024 at 01:26:52PM +0800, Ma Ke wrote:
> > > The return value of drm_atomic_get_crtc_state() needs to be
> > > checked. To avoid use of error pointer 'crtc_state' in case
> > > of the failure.
> > > 
> > > Cc: stable@vger.kernel.org
> > > Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check")
> > > 
> > > Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> > > ---
> > >  drivers/gpu/drm/sti/sti_cursor.c | 2 ++
> > >  1 file changed, 2 insertions(+)
> > > 
> > > diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
> > > index db0a1eb53532..e460f5ba2d87 100644
> > > --- a/drivers/gpu/drm/sti/sti_cursor.c
> > > +++ b/drivers/gpu/drm/sti/sti_cursor.c
> > > @@ -200,6 +200,8 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
> > >  		return 0;
> > >  
> > >  	crtc_state = drm_atomic_get_crtc_state(state, crtc);
> > > +	if (IS_ERR(crtc_state))
> > > +		return PTR_ERR(crtc_state);
> > >  	mode = &crtc_state->mode;
> > >  	dst_x = new_plane_state->crtc_x;
> > >  	dst_y = new_plane_state->crtc_y;
> > > -- 
> > > 2.25.1
> > > 
Hi，

I appreciate your guidance regarding the modification of the Fixes tag. As 
your observation, I have also identified the additional instance
(sti_hqvdp_atomic_check) where a similar issue exists, necessitating the 
same patch. I have recognized the problem and was in the process of 
reporting it. To prevent any confusion and ensure accurate reporting, I 
have updated the patch already submitted as patch v2. The issue in 
sti_hqvdp_atomic_check has also been reported, and I kindly request you to 
review it.(I am not very familiar with how to combine the reporting of 
vulnerabilities in multiple functions, so to avoid unnecessary errors or 
confusion, I reported them one by one. Hope for your understanding.) Thank 
you for your prompt response. Your assistance is invaluable to me.

Best regards,
Ma Ke

Re: [PATCH RESEND] drm/sti: avoid potential dereference of error pointers

Posted by Raphaël Gallais-Pou 1 year, 3 months ago


Le 26/08/2024 à 07:26, Ma Ke a écrit :
> The return value of drm_atomic_get_crtc_state() needs to be
> checked. To avoid use of error pointer 'crtc_state' in case
> of the failure.
>
> Cc: stable@vger.kernel.org
> Fixes: dec92020671c ("drm: Use the state pointer directly in planes atomic_check")
>
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
>
Hi,

Tested-by: Raphaël Gallais-Pou <rgallaispou@gmail.com>

Regards,
Raphaël