From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sasha Levin <sashal@kernel.org>, airlied@linux.ie, Liviu Dudau <liviu.dudau@arm.com>, Steven Price <steven.price@arm.com>, dri-devel@lists.freedesktop.org, tzimmermann@suse.de Subject: [PATCH AUTOSEL 4.19 18/38] drm/plane: Move range check for format_count earlier Date: Mon, 30 May 2022 09:49:04 -0400 [thread overview] Message-ID: <20220530134924.1936816-18-sashal@kernel.org> (raw) In-Reply-To: <20220530134924.1936816-1-sashal@kernel.org> From: Steven Price <steven.price@arm.com> [ Upstream commit 4b674dd69701c2e22e8e7770c1706a69f3b17269 ] While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place. Signed-off-by: Steven Price <steven.price@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://lore.kernel.org/dri-devel/20211203102815.38624-1-steven.price@arm.com/ Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/gpu/drm/drm_plane.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c index 2411b6de055e..425e76e39b3b 100644 --- a/drivers/gpu/drm/drm_plane.c +++ b/drivers/gpu/drm/drm_plane.c @@ -177,6 +177,13 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, if (WARN_ON(config->num_total_plane >= 32)) return -EINVAL; + /* + * First driver to need more than 64 formats needs to fix this. Each + * format is encoded as a bit and the current code only supports a u64. + */ + if (WARN_ON(format_count > 64)) + return -EINVAL; + WARN_ON(drm_drv_uses_atomic_modeset(dev) && (!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state)); @@ -198,13 +205,6 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, return -ENOMEM; } - /* - * First driver to need more than 64 formats needs to fix this. Each - * format is encoded as a bit and the current code only supports a u64. - */ - if (WARN_ON(format_count > 64)) - return -EINVAL; - if (format_modifiers) { const uint64_t *temp_modifiers = format_modifiers; while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID) -- 2.35.1
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Steven Price <steven.price@arm.com>, Liviu Dudau <liviu.dudau@arm.com>, Sasha Levin <sashal@kernel.org>, maarten.lankhorst@linux.intel.com, mripard@kernel.org, tzimmermann@suse.de, airlied@linux.ie, daniel@ffwll.ch, dri-devel@lists.freedesktop.org Subject: [PATCH AUTOSEL 4.19 18/38] drm/plane: Move range check for format_count earlier Date: Mon, 30 May 2022 09:49:04 -0400 [thread overview] Message-ID: <20220530134924.1936816-18-sashal@kernel.org> (raw) In-Reply-To: <20220530134924.1936816-1-sashal@kernel.org> From: Steven Price <steven.price@arm.com> [ Upstream commit 4b674dd69701c2e22e8e7770c1706a69f3b17269 ] While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place. Signed-off-by: Steven Price <steven.price@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://lore.kernel.org/dri-devel/20211203102815.38624-1-steven.price@arm.com/ Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/gpu/drm/drm_plane.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c index 2411b6de055e..425e76e39b3b 100644 --- a/drivers/gpu/drm/drm_plane.c +++ b/drivers/gpu/drm/drm_plane.c @@ -177,6 +177,13 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, if (WARN_ON(config->num_total_plane >= 32)) return -EINVAL; + /* + * First driver to need more than 64 formats needs to fix this. Each + * format is encoded as a bit and the current code only supports a u64. + */ + if (WARN_ON(format_count > 64)) + return -EINVAL; + WARN_ON(drm_drv_uses_atomic_modeset(dev) && (!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state)); @@ -198,13 +205,6 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, return -ENOMEM; } - /* - * First driver to need more than 64 formats needs to fix this. Each - * format is encoded as a bit and the current code only supports a u64. - */ - if (WARN_ON(format_count > 64)) - return -EINVAL; - if (format_modifiers) { const uint64_t *temp_modifiers = format_modifiers; while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID) -- 2.35.1
next prev parent reply other threads:[~2022-05-30 14:08 UTC|newest] Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-05-30 13:48 [PATCH AUTOSEL 4.19 01/38] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 02/38] mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 03/38] b43legacy: Fix assigning negative value to unsigned variable Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 04/38] b43: " Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 05/38] ipw2x00: Fix potential NULL dereference in libipw_xmit() Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 06/38] ipv6: fix locking issues with loops over idev->addr_list Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 07/38] fbcon: Consistently protect deferred_takeover with console_lock() Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 08/38] ACPICA: Avoid cache flush inside virtual machines Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 09/38] ALSA: jack: Access input_dev under mutex Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 10/38] drm/amd/pm: fix double free in si_parse_power_table() Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 11/38] ath9k: fix QCA9561 PA bias level Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 12/38] media: venus: hfi: avoid null dereference in deinit Sasha Levin 2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 13/38] media: pci: cx23885: Fix the error handling in cx23885_initdev() Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 14/38] media: cx25821: Fix the warning when removing the module Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 15/38] md/bitmap: don't set sb values if can't pass sanity check Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 16/38] drm/sun4i: Add support for D1 TCONs Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 14:41 ` Samuel Holland 2022-05-30 14:41 ` Samuel Holland 2022-05-30 14:41 ` Samuel Holland 2022-06-05 13:28 ` Sasha Levin 2022-06-05 13:28 ` Sasha Levin 2022-06-05 13:28 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 17/38] scsi: megaraid: Fix error check return value of register_chrdev() Sasha Levin 2022-05-30 13:49 ` Sasha Levin [this message] 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 18/38] drm/plane: Move range check for format_count earlier Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 19/38] drm/amd/pm: fix the compile warning Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 20/38] ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 21/38] ASoC: dapm: Don't fold register value changes into notifications Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 22/38] mlxsw: spectrum_dcb: Do not warn about priority changes Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 23/38] ASoC: tscs454: Add endianness flag in snd_soc_component_driver Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 24/38] net: remove two BUG() from skb_checksum_help() Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 25/38] s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 26/38] dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 27/38] ipmi:ssif: Check for NULL msg when handling events and messages Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 28/38] rtlwifi: Use pr_warn instead of WARN_ONCE Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 29/38] media: cec-adap.c: fix is_configuring state Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 30/38] openrisc: start CPU timer early in boot Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 31/38] nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 32/38] ASoC: rt5645: Fix errorenous cleanup order Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 33/38] net: phy: micrel: Allow probing without .driver_data Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 34/38] media: exynos4-is: Fix compile warning Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 35/38] ARM: 9201/1: spectre-bhb: rely on linker to emit cross-section literal loads Sasha Levin 2022-05-30 13:49 ` Sasha Levin 2022-05-30 13:52 ` Ard Biesheuvel 2022-05-30 13:52 ` Ard Biesheuvel 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 36/38] hwmon: Make chip parameter for with_info API mandatory Sasha Levin 2022-05-30 14:29 ` Guenter Roeck 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 37/38] rxrpc: Return an error to sendmsg if call failed Sasha Levin 2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 38/38] eth: tg3: silence the GCC 12 array-bounds warning Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220530134924.1936816-18-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=airlied@linux.ie \ --cc=dri-devel@lists.freedesktop.org \ --cc=linux-kernel@vger.kernel.org \ --cc=liviu.dudau@arm.com \ --cc=stable@vger.kernel.org \ --cc=steven.price@arm.com \ --cc=tzimmermann@suse.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.