From: Hassan Shahbazi <h.shahbazi.git@gmail.com> To: Greg KH <gregkh@linuxfoundation.org> Cc: daniel.vetter@ffwll.ch, jirislaby@kernel.org, yepeilin.cs@gmail.com, linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, h.shahbazi.git@gmail.com Subject: Re: [PATCH] fix NULL pointer deference crash Date: Thu, 1 Apr 2021 09:21:54 +0300 [thread overview] Message-ID: <20210401062154.5evjajj64r4tjseh@gentoo> (raw) In-Reply-To: <YGSyFgeNd7gfsbR6@kroah.com> On Wed, Mar 31, 2021 at 07:32:06PM +0200, Greg KH wrote: > On Wed, Mar 31, 2021 at 07:34:29PM +0300, Hassan Shahbazi wrote: > > The patch has fixed a NULL pointer deference crash in hiding the cursor. It > > is verified by syzbot patch tester. > > > > Reported by: syzbot > > https://syzkaller.appspot.com/bug?id=defb47bf56e1c14d5687280c7bb91ce7b608b94b > > > > Signed-off-by: Hassan Shahbazi <h.shahbazi.git@gmail.com> > > --- > > drivers/video/fbdev/core/fbcon.c | 5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c > > index 44a5cd2f54cc..ee252d1c43c6 100644 > > --- a/drivers/video/fbdev/core/fbcon.c > > +++ b/drivers/video/fbdev/core/fbcon.c > > @@ -1333,8 +1333,9 @@ static void fbcon_cursor(struct vc_data *vc, int mode) > > > > ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1; > > > > - ops->cursor(vc, info, mode, get_color(vc, info, c, 1), > > - get_color(vc, info, c, 0)); > > + if (ops && ops->cursor) > > As ops obviously is not NULL here (you just used it on the line above), > why are you checking it again? Yes, that's right. I will remove that check and will submit a new patch. > And what makes curser be NULL here? How can that happen? Honestly, I don't know. I reproduced the crash on my local, followed the stack trace, and then changed the line to avoid the crash. If you think this patch is not the best solution, I can drop it and investigate more to find the root cause. > Also your subject line can use some work, please make it reflect the > driver subsystem you are looking at. This was a mistake, I did not intend to change the subject. I will ensure the next patch reflects the subsystem. > thanks, > > greg k-h Best, Hassan Shahbazi
WARNING: multiple messages have this Message-ID (diff)
From: Hassan Shahbazi <h.shahbazi.git@gmail.com> To: Greg KH <gregkh@linuxfoundation.org> Cc: linux-fbdev@vger.kernel.org, daniel.vetter@ffwll.ch, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, h.shahbazi.git@gmail.com, jirislaby@kernel.org, yepeilin.cs@gmail.com Subject: Re: [PATCH] fix NULL pointer deference crash Date: Thu, 1 Apr 2021 09:21:54 +0300 [thread overview] Message-ID: <20210401062154.5evjajj64r4tjseh@gentoo> (raw) In-Reply-To: <YGSyFgeNd7gfsbR6@kroah.com> On Wed, Mar 31, 2021 at 07:32:06PM +0200, Greg KH wrote: > On Wed, Mar 31, 2021 at 07:34:29PM +0300, Hassan Shahbazi wrote: > > The patch has fixed a NULL pointer deference crash in hiding the cursor. It > > is verified by syzbot patch tester. > > > > Reported by: syzbot > > https://syzkaller.appspot.com/bug?id=defb47bf56e1c14d5687280c7bb91ce7b608b94b > > > > Signed-off-by: Hassan Shahbazi <h.shahbazi.git@gmail.com> > > --- > > drivers/video/fbdev/core/fbcon.c | 5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c > > index 44a5cd2f54cc..ee252d1c43c6 100644 > > --- a/drivers/video/fbdev/core/fbcon.c > > +++ b/drivers/video/fbdev/core/fbcon.c > > @@ -1333,8 +1333,9 @@ static void fbcon_cursor(struct vc_data *vc, int mode) > > > > ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1; > > > > - ops->cursor(vc, info, mode, get_color(vc, info, c, 1), > > - get_color(vc, info, c, 0)); > > + if (ops && ops->cursor) > > As ops obviously is not NULL here (you just used it on the line above), > why are you checking it again? Yes, that's right. I will remove that check and will submit a new patch. > And what makes curser be NULL here? How can that happen? Honestly, I don't know. I reproduced the crash on my local, followed the stack trace, and then changed the line to avoid the crash. If you think this patch is not the best solution, I can drop it and investigate more to find the root cause. > Also your subject line can use some work, please make it reflect the > driver subsystem you are looking at. This was a mistake, I did not intend to change the subject. I will ensure the next patch reflects the subsystem. > thanks, > > greg k-h Best, Hassan Shahbazi _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2021-04-01 6:22 UTC|newest] Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-03-31 16:34 [PATCH] fix NULL pointer deference crash Hassan Shahbazi 2021-03-31 16:34 ` Hassan Shahbazi 2021-03-31 17:32 ` Greg KH 2021-03-31 17:32 ` Greg KH 2021-04-01 6:21 ` Hassan Shahbazi [this message] 2021-04-01 6:21 ` Hassan Shahbazi 2021-04-01 6:54 ` Greg KH 2021-04-01 6:54 ` Greg KH 2021-03-31 20:02 ` Dan Carpenter 2021-03-31 20:02 ` Dan Carpenter 2021-03-31 20:02 ` Dan Carpenter 2021-03-31 20:02 ` Dan Carpenter 2021-03-31 19:29 kernel test robot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210401062154.5evjajj64r4tjseh@gentoo \ --to=h.shahbazi.git@gmail.com \ --cc=daniel.vetter@ffwll.ch \ --cc=dri-devel@lists.freedesktop.org \ --cc=gregkh@linuxfoundation.org \ --cc=jirislaby@kernel.org \ --cc=linux-fbdev@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=yepeilin.cs@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.