All of lore.kernel.org
 help / color / mirror / Atom feed
From: Oleksandr Andrushchenko <andr2000@gmail.com>
To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc: daniel.vetter@intel.com, gustavo@padovan.org, airlied@linux.ie,
	seanpaul@chromium.org,
	Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Subject: [PATCH] drm/simple_kms_helper: Fix NULL pointer dereference with no active CRTC
Date: Tue, 13 Feb 2018 10:44:16 +0200	[thread overview]
Message-ID: <1518511456-28257-1-git-send-email-andr2000@gmail.com> (raw)

From: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>

It is possible that drm_simple_kms_plane_atomic_check called
with no CRTC set, e.g. when user-space application sets CRTC_ID/FB_ID
to 0 before doing any actual drawing. This leads to NULL pointer
dereference because in this case new CRTC state is NULL and must be
checked before accessing.

Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
---
 drivers/gpu/drm/drm_simple_kms_helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_simple_kms_helper.c b/drivers/gpu/drm/drm_simple_kms_helper.c
index 9ca8a4a59b74..a05eca9cec8b 100644
--- a/drivers/gpu/drm/drm_simple_kms_helper.c
+++ b/drivers/gpu/drm/drm_simple_kms_helper.c
@@ -121,8 +121,10 @@ static int drm_simple_kms_plane_atomic_check(struct drm_plane *plane,
 	pipe = container_of(plane, struct drm_simple_display_pipe, plane);
 	crtc_state = drm_atomic_get_new_crtc_state(plane_state->state,
 						   &pipe->crtc);
-	if (!crtc_state->enable)
-		return 0; /* nothing to check when disabling or disabled */
+
+	if (!crtc_state || !crtc_state->enable)
+		/* nothing to check when disabling or disabled or no CRTC set */
+		return 0;
 
 	if (crtc_state->enable)
 		drm_mode_get_hv_timing(&crtc_state->mode,
-- 
2.7.4

WARNING: multiple messages have this Message-ID (diff)
From: Oleksandr Andrushchenko <andr2000@gmail.com>
To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc: airlied@linux.ie, daniel.vetter@intel.com,
	Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Subject: [PATCH] drm/simple_kms_helper: Fix NULL pointer dereference with no active CRTC
Date: Tue, 13 Feb 2018 10:44:16 +0200	[thread overview]
Message-ID: <1518511456-28257-1-git-send-email-andr2000@gmail.com> (raw)

From: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>

It is possible that drm_simple_kms_plane_atomic_check called
with no CRTC set, e.g. when user-space application sets CRTC_ID/FB_ID
to 0 before doing any actual drawing. This leads to NULL pointer
dereference because in this case new CRTC state is NULL and must be
checked before accessing.

Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
---
 drivers/gpu/drm/drm_simple_kms_helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_simple_kms_helper.c b/drivers/gpu/drm/drm_simple_kms_helper.c
index 9ca8a4a59b74..a05eca9cec8b 100644
--- a/drivers/gpu/drm/drm_simple_kms_helper.c
+++ b/drivers/gpu/drm/drm_simple_kms_helper.c
@@ -121,8 +121,10 @@ static int drm_simple_kms_plane_atomic_check(struct drm_plane *plane,
 	pipe = container_of(plane, struct drm_simple_display_pipe, plane);
 	crtc_state = drm_atomic_get_new_crtc_state(plane_state->state,
 						   &pipe->crtc);
-	if (!crtc_state->enable)
-		return 0; /* nothing to check when disabling or disabled */
+
+	if (!crtc_state || !crtc_state->enable)
+		/* nothing to check when disabling or disabled or no CRTC set */
+		return 0;
 
 	if (crtc_state->enable)
 		drm_mode_get_hv_timing(&crtc_state->mode,
-- 
2.7.4

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

             reply	other threads:[~2018-02-13  8:44 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-02-13  8:44 Oleksandr Andrushchenko [this message]
2018-02-13  8:44 ` [PATCH] drm/simple_kms_helper: Fix NULL pointer dereference with no active CRTC Oleksandr Andrushchenko
2018-02-19 14:30 ` Daniel Vetter
2018-02-19 14:30   ` Daniel Vetter
2018-02-19 14:58   ` Oleksandr Andrushchenko
2018-02-19 14:58     ` Oleksandr Andrushchenko
2018-02-20 11:17     ` Daniel Vetter
2018-02-20 11:17       ` Daniel Vetter
2018-02-20 12:36       ` Oleksandr Andrushchenko
2018-02-20 12:36         ` Oleksandr Andrushchenko
2018-02-20 12:49         ` Daniel Vetter
2018-02-20 12:49           ` Daniel Vetter
2018-02-20 12:53           ` Oleksandr Andrushchenko
2018-02-20 12:53             ` Oleksandr Andrushchenko
2018-02-20 13:29             ` Oleksandr Andrushchenko
2018-02-20 13:29               ` Oleksandr Andrushchenko
2018-03-05  8:52               ` Daniel Vetter
2018-03-05  8:55                 ` Oleksandr Andrushchenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1518511456-28257-1-git-send-email-andr2000@gmail.com \
    --to=andr2000@gmail.com \
    --cc=airlied@linux.ie \
    --cc=daniel.vetter@intel.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gustavo@padovan.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oleksandr_andrushchenko@epam.com \
    --cc=seanpaul@chromium.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.