* [PATCH] drm/msm: Fix potential NULL dereference in DPU
@ 2021-10-20 18:38 Jessica Zhang
2021-11-25 13:18 ` Dmitry Baryshkov
0 siblings, 1 reply; 2+ messages in thread
From: Jessica Zhang @ 2021-10-20 18:38 UTC (permalink / raw)
To: freedreno
Cc: Jessica Zhang, linux-arm-msm, dan.carpenter, dri-devel,
dmitry.baryshkov, nganji, aravindh, abhinavk
Add NULL checks in KMS CRTC funcs to avoid potential NULL
dereference.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jessica Zhang <jesszhan@codeaurora.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c | 8 ++++++++
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 +++++
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +++
drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 3 +++
drivers/gpu/drm/msm/msm_gpu.c | 3 +++
5 files changed, 22 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
index d2457490930b..53d80572181e 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
@@ -208,8 +208,16 @@ void dpu_core_irq_preinstall(struct dpu_kms *dpu_kms)
dpu_kms->irq_obj.total_irqs = dpu_kms->hw_intr->total_irqs;
dpu_kms->irq_obj.irq_cb_tbl = kcalloc(dpu_kms->irq_obj.total_irqs,
sizeof(struct list_head), GFP_KERNEL);
+
+ if (!dpu_kms->irq_obj.irq_cb_tbl)
+ return;
+
dpu_kms->irq_obj.irq_counts = kcalloc(dpu_kms->irq_obj.total_irqs,
sizeof(atomic_t), GFP_KERNEL);
+
+ if (!dpu_kms->irq_obj.irq_counts)
+ return;
+
for (i = 0; i < dpu_kms->irq_obj.total_irqs; i++) {
INIT_LIST_HEAD(&dpu_kms->irq_obj.irq_cb_tbl[i]);
atomic_set(&dpu_kms->irq_obj.irq_counts[i], 0);
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index 768012243b44..0a1cad0cfcc0 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -921,6 +921,11 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL);
+ if (!pstates) {
+ rc = -ENOMEM;
+ goto end;
+ }
+
if (!crtc_state->enable || !crtc_state->active) {
DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
crtc->base.id, crtc_state->enable,
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
index c6b69afcbac8..09751b480db5 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
@@ -92,6 +92,9 @@ static void mdp5_plane_reset(struct drm_plane *plane)
kfree(to_mdp5_plane_state(plane->state));
mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL);
+ if (!mdp5_state)
+ return;
+
if (plane->type == DRM_PLANE_TYPE_PRIMARY)
mdp5_state->base.zpos = STAGE_BASE;
else
diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
index cabe15190ec1..71e209d07120 100644
--- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
+++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
@@ -170,6 +170,9 @@ void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len,
new_blk = kzalloc(sizeof(struct msm_disp_state_block), GFP_KERNEL);
+ if (!new_blk)
+ return;
+
va_start(va, fmt);
vaf.fmt = fmt;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 8a3a592da3a4..ddd23f3a4a99 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -296,6 +296,9 @@ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
state->bos = kcalloc(nr,
sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
+ if (!state->bos)
+ return;
+
for (i = 0; i < submit->nr_bos; i++) {
if (should_dump(submit, i)) {
msm_gpu_crashstate_get_bo(state, submit->bos[i].obj,
--
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/msm: Fix potential NULL dereference in DPU
2021-10-20 18:38 [PATCH] drm/msm: Fix potential NULL dereference in DPU Jessica Zhang
@ 2021-11-25 13:18 ` Dmitry Baryshkov
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Baryshkov @ 2021-11-25 13:18 UTC (permalink / raw)
To: Jessica Zhang, freedreno
Cc: linux-arm-msm, abhinavk, nganji, dri-devel, aravindh, dan.carpenter
On 20/10/2021 21:38, Jessica Zhang wrote:
> Add NULL checks in KMS CRTC funcs to avoid potential NULL
> dereference.
>
> Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
I believe that single Fixes is incorrect here. For example snapshot
support was added later. I'd suggest to split the patch and provide
correct Fixes tags.
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Jessica Zhang <jesszhan@codeaurora.org>
> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c | 8 ++++++++
No such file.
> drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 +++++
> drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +++
> drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 3 +++
> drivers/gpu/drm/msm/msm_gpu.c | 3 +++
> 5 files changed, 22 insertions(+)
>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
> index d2457490930b..53d80572181e 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_irq.c
> @@ -208,8 +208,16 @@ void dpu_core_irq_preinstall(struct dpu_kms *dpu_kms)
> dpu_kms->irq_obj.total_irqs = dpu_kms->hw_intr->total_irqs;
> dpu_kms->irq_obj.irq_cb_tbl = kcalloc(dpu_kms->irq_obj.total_irqs,
> sizeof(struct list_head), GFP_KERNEL);
> +
> + if (!dpu_kms->irq_obj.irq_cb_tbl)
> + return;
> +
> dpu_kms->irq_obj.irq_counts = kcalloc(dpu_kms->irq_obj.total_irqs,
> sizeof(atomic_t), GFP_KERNEL);
> +
> + if (!dpu_kms->irq_obj.irq_counts)
> + return;
> +
> for (i = 0; i < dpu_kms->irq_obj.total_irqs; i++) {
> INIT_LIST_HEAD(&dpu_kms->irq_obj.irq_cb_tbl[i]);
> atomic_set(&dpu_kms->irq_obj.irq_counts[i], 0);
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> index 768012243b44..0a1cad0cfcc0 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
> @@ -921,6 +921,11 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
>
> pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL);
>
> + if (!pstates) {
> + rc = -ENOMEM;
> + goto end;
> + }
> +
> if (!crtc_state->enable || !crtc_state->active) {
> DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
> crtc->base.id, crtc_state->enable,
> diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
> index c6b69afcbac8..09751b480db5 100644
> --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
> +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
> @@ -92,6 +92,9 @@ static void mdp5_plane_reset(struct drm_plane *plane)
> kfree(to_mdp5_plane_state(plane->state));
> mdp5_state = kzalloc(sizeof(*mdp5_state), GFP_KERNEL);
>
> + if (!mdp5_state)
> + return;
> +
> if (plane->type == DRM_PLANE_TYPE_PRIMARY)
> mdp5_state->base.zpos = STAGE_BASE;
> else
> diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
> index cabe15190ec1..71e209d07120 100644
> --- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
> +++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c
> @@ -170,6 +170,9 @@ void msm_disp_snapshot_add_block(struct msm_disp_state *disp_state, u32 len,
>
> new_blk = kzalloc(sizeof(struct msm_disp_state_block), GFP_KERNEL);
>
> + if (!new_blk)
> + return;
> +
> va_start(va, fmt);
>
> vaf.fmt = fmt;
> diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
> index 8a3a592da3a4..ddd23f3a4a99 100644
> --- a/drivers/gpu/drm/msm/msm_gpu.c
> +++ b/drivers/gpu/drm/msm/msm_gpu.c
> @@ -296,6 +296,9 @@ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
> state->bos = kcalloc(nr,
> sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
>
> + if (!state->bos)
> + return;
> +
> for (i = 0; i < submit->nr_bos; i++) {
> if (should_dump(submit, i)) {
> msm_gpu_crashstate_get_bo(state, submit->bos[i].obj,
>
--
With best wishes
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-25 13:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-20 18:38 [PATCH] drm/msm: Fix potential NULL dereference in DPU Jessica Zhang
2021-11-25 13:18 ` Dmitry Baryshkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).