All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/gma500: Fix end of loop tests for list_for_each_entry
@ 2021-07-09  7:39 ` Harshvardhan Jha
  0 siblings, 0 replies; 4+ messages in thread
From: Harshvardhan Jha @ 2021-07-09  7:39 UTC (permalink / raw)
  To: patrik.r.jakobsson
  Cc: airlied, daniel, dri-devel, linux-kernel, dan.carpenter,
	Harshvardhan Jha

The list_for_each_entry() iterator, "connector" in this code, can never be
NULL.  If we exit the loop without finding the correct  connector then
"connector" points invalid memory that is an offset from the list head.
This will eventually lead to memory corruption and presumably a kernel
crash.

Fixes: 9bd81acdb648 ("gma500: Convert Oaktrail to work with new output handling")
Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
 ---
From static analysis.  Not tested.
---
 drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c b/drivers/gpu/drm/gma500/oaktrail_lvds.c
index 432bdcc57ac9..a1332878857b 100644
--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
+++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
@@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder,
 			continue;
 	}
 
-	if (!connector) {
+	if (list_entry_is_head(connector, &mode_config->connector_list, head)) {
 		DRM_ERROR("Couldn't find connector when setting mode");
 		gma_power_end(dev);
 		return;
-- 
2.32.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH] drm/gma500: Fix end of loop tests for list_for_each_entry
@ 2021-07-09  7:39 ` Harshvardhan Jha
  0 siblings, 0 replies; 4+ messages in thread
From: Harshvardhan Jha @ 2021-07-09  7:39 UTC (permalink / raw)
  To: patrik.r.jakobsson
  Cc: airlied, linux-kernel, dri-devel, Harshvardhan Jha, dan.carpenter

The list_for_each_entry() iterator, "connector" in this code, can never be
NULL.  If we exit the loop without finding the correct  connector then
"connector" points invalid memory that is an offset from the list head.
This will eventually lead to memory corruption and presumably a kernel
crash.

Fixes: 9bd81acdb648 ("gma500: Convert Oaktrail to work with new output handling")
Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
 ---
From static analysis.  Not tested.
---
 drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c b/drivers/gpu/drm/gma500/oaktrail_lvds.c
index 432bdcc57ac9..a1332878857b 100644
--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
+++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
@@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder,
 			continue;
 	}
 
-	if (!connector) {
+	if (list_entry_is_head(connector, &mode_config->connector_list, head)) {
 		DRM_ERROR("Couldn't find connector when setting mode");
 		gma_power_end(dev);
 		return;
-- 
2.32.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH] drm/gma500: Fix end of loop tests for list_for_each_entry
  2021-07-09  7:39 ` Harshvardhan Jha
@ 2021-07-09  8:07   ` Daniel Vetter
  -1 siblings, 0 replies; 4+ messages in thread
From: Daniel Vetter @ 2021-07-09  8:07 UTC (permalink / raw)
  To: Harshvardhan Jha
  Cc: patrik.r.jakobsson, airlied, daniel, dri-devel, linux-kernel,
	dan.carpenter

On Fri, Jul 09, 2021 at 01:09:59PM +0530, Harshvardhan Jha wrote:
> The list_for_each_entry() iterator, "connector" in this code, can never be
> NULL.  If we exit the loop without finding the correct  connector then
> "connector" points invalid memory that is an offset from the list head.
> This will eventually lead to memory corruption and presumably a kernel
> crash.
> 
> Fixes: 9bd81acdb648 ("gma500: Convert Oaktrail to work with new output handling")
> Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
>  ---

The space here before the --- tripped the tooling, but I caught it :-)

Thanks for the patch, applied to drm-misc-next for 5.15.
-Daniel

> From static analysis.  Not tested.
> ---
>  drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c b/drivers/gpu/drm/gma500/oaktrail_lvds.c
> index 432bdcc57ac9..a1332878857b 100644
> --- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
> +++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
> @@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder,
>  			continue;
>  	}
>  
> -	if (!connector) {
> +	if (list_entry_is_head(connector, &mode_config->connector_list, head)) {
>  		DRM_ERROR("Couldn't find connector when setting mode");
>  		gma_power_end(dev);
>  		return;
> -- 
> 2.32.0
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH] drm/gma500: Fix end of loop tests for list_for_each_entry
@ 2021-07-09  8:07   ` Daniel Vetter
  0 siblings, 0 replies; 4+ messages in thread
From: Daniel Vetter @ 2021-07-09  8:07 UTC (permalink / raw)
  To: Harshvardhan Jha; +Cc: airlied, linux-kernel, dri-devel, dan.carpenter

On Fri, Jul 09, 2021 at 01:09:59PM +0530, Harshvardhan Jha wrote:
> The list_for_each_entry() iterator, "connector" in this code, can never be
> NULL.  If we exit the loop without finding the correct  connector then
> "connector" points invalid memory that is an offset from the list head.
> This will eventually lead to memory corruption and presumably a kernel
> crash.
> 
> Fixes: 9bd81acdb648 ("gma500: Convert Oaktrail to work with new output handling")
> Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
>  ---

The space here before the --- tripped the tooling, but I caught it :-)

Thanks for the patch, applied to drm-misc-next for 5.15.
-Daniel

> From static analysis.  Not tested.
> ---
>  drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c b/drivers/gpu/drm/gma500/oaktrail_lvds.c
> index 432bdcc57ac9..a1332878857b 100644
> --- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
> +++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
> @@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder,
>  			continue;
>  	}
>  
> -	if (!connector) {
> +	if (list_entry_is_head(connector, &mode_config->connector_list, head)) {
>  		DRM_ERROR("Couldn't find connector when setting mode");
>  		gma_power_end(dev);
>  		return;
> -- 
> 2.32.0
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-07-09  9:01 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-09  7:39 [PATCH] drm/gma500: Fix end of loop tests for list_for_each_entry Harshvardhan Jha
2021-07-09  7:39 ` Harshvardhan Jha
2021-07-09  8:07 ` Daniel Vetter
2021-07-09  8:07   ` Daniel Vetter

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.