All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
	airlied@linux.ie, Liviu Dudau <liviu.dudau@arm.com>,
	Steven Price <steven.price@arm.com>,
	dri-devel@lists.freedesktop.org, tzimmermann@suse.de
Subject: [PATCH AUTOSEL 4.19 18/38] drm/plane: Move range check for format_count earlier
Date: Mon, 30 May 2022 09:49:04 -0400	[thread overview]
Message-ID: <20220530134924.1936816-18-sashal@kernel.org> (raw)
In-Reply-To: <20220530134924.1936816-1-sashal@kernel.org>

From: Steven Price <steven.price@arm.com>

[ Upstream commit 4b674dd69701c2e22e8e7770c1706a69f3b17269 ]

While the check for format_count > 64 in __drm_universal_plane_init()
shouldn't be hit (it's a WARN_ON), in its current position it will then
leak the plane->format_types array and fail to call
drm_mode_object_unregister() leaking the modeset identifier. Move it to
the start of the function to avoid allocating those resources in the
first place.

Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://lore.kernel.org/dri-devel/20211203102815.38624-1-steven.price@arm.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_plane.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 2411b6de055e..425e76e39b3b 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -177,6 +177,13 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
 	if (WARN_ON(config->num_total_plane >= 32))
 		return -EINVAL;
 
+	/*
+	 * First driver to need more than 64 formats needs to fix this. Each
+	 * format is encoded as a bit and the current code only supports a u64.
+	 */
+	if (WARN_ON(format_count > 64))
+		return -EINVAL;
+
 	WARN_ON(drm_drv_uses_atomic_modeset(dev) &&
 		(!funcs->atomic_destroy_state ||
 		 !funcs->atomic_duplicate_state));
@@ -198,13 +205,6 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
 		return -ENOMEM;
 	}
 
-	/*
-	 * First driver to need more than 64 formats needs to fix this. Each
-	 * format is encoded as a bit and the current code only supports a u64.
-	 */
-	if (WARN_ON(format_count > 64))
-		return -EINVAL;
-
 	if (format_modifiers) {
 		const uint64_t *temp_modifiers = format_modifiers;
 		while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID)
-- 
2.35.1


WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Steven Price <steven.price@arm.com>,
	Liviu Dudau <liviu.dudau@arm.com>,
	Sasha Levin <sashal@kernel.org>,
	maarten.lankhorst@linux.intel.com, mripard@kernel.org,
	tzimmermann@suse.de, airlied@linux.ie, daniel@ffwll.ch,
	dri-devel@lists.freedesktop.org
Subject: [PATCH AUTOSEL 4.19 18/38] drm/plane: Move range check for format_count earlier
Date: Mon, 30 May 2022 09:49:04 -0400	[thread overview]
Message-ID: <20220530134924.1936816-18-sashal@kernel.org> (raw)
In-Reply-To: <20220530134924.1936816-1-sashal@kernel.org>

From: Steven Price <steven.price@arm.com>

[ Upstream commit 4b674dd69701c2e22e8e7770c1706a69f3b17269 ]

While the check for format_count > 64 in __drm_universal_plane_init()
shouldn't be hit (it's a WARN_ON), in its current position it will then
leak the plane->format_types array and fail to call
drm_mode_object_unregister() leaking the modeset identifier. Move it to
the start of the function to avoid allocating those resources in the
first place.

Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://lore.kernel.org/dri-devel/20211203102815.38624-1-steven.price@arm.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_plane.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 2411b6de055e..425e76e39b3b 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -177,6 +177,13 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
 	if (WARN_ON(config->num_total_plane >= 32))
 		return -EINVAL;
 
+	/*
+	 * First driver to need more than 64 formats needs to fix this. Each
+	 * format is encoded as a bit and the current code only supports a u64.
+	 */
+	if (WARN_ON(format_count > 64))
+		return -EINVAL;
+
 	WARN_ON(drm_drv_uses_atomic_modeset(dev) &&
 		(!funcs->atomic_destroy_state ||
 		 !funcs->atomic_duplicate_state));
@@ -198,13 +205,6 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane,
 		return -ENOMEM;
 	}
 
-	/*
-	 * First driver to need more than 64 formats needs to fix this. Each
-	 * format is encoded as a bit and the current code only supports a u64.
-	 */
-	if (WARN_ON(format_count > 64))
-		return -EINVAL;
-
 	if (format_modifiers) {
 		const uint64_t *temp_modifiers = format_modifiers;
 		while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID)
-- 
2.35.1


  parent reply	other threads:[~2022-05-30 14:08 UTC|newest]

Thread overview: 66+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-30 13:48 [PATCH AUTOSEL 4.19 01/38] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes Sasha Levin
2022-05-30 13:48 ` Sasha Levin
2022-05-30 13:48 ` Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 02/38] mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 03/38] b43legacy: Fix assigning negative value to unsigned variable Sasha Levin
2022-05-30 13:48   ` Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 04/38] b43: " Sasha Levin
2022-05-30 13:48   ` Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 05/38] ipw2x00: Fix potential NULL dereference in libipw_xmit() Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 06/38] ipv6: fix locking issues with loops over idev->addr_list Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 07/38] fbcon: Consistently protect deferred_takeover with console_lock() Sasha Levin
2022-05-30 13:48   ` Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 08/38] ACPICA: Avoid cache flush inside virtual machines Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 09/38] ALSA: jack: Access input_dev under mutex Sasha Levin
2022-05-30 13:48   ` Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 10/38] drm/amd/pm: fix double free in si_parse_power_table() Sasha Levin
2022-05-30 13:48   ` Sasha Levin
2022-05-30 13:48   ` Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 11/38] ath9k: fix QCA9561 PA bias level Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 12/38] media: venus: hfi: avoid null dereference in deinit Sasha Levin
2022-05-30 13:48 ` [PATCH AUTOSEL 4.19 13/38] media: pci: cx23885: Fix the error handling in cx23885_initdev() Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 14/38] media: cx25821: Fix the warning when removing the module Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 15/38] md/bitmap: don't set sb values if can't pass sanity check Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 16/38] drm/sun4i: Add support for D1 TCONs Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 14:41   ` Samuel Holland
2022-05-30 14:41     ` Samuel Holland
2022-05-30 14:41     ` Samuel Holland
2022-06-05 13:28     ` Sasha Levin
2022-06-05 13:28       ` Sasha Levin
2022-06-05 13:28       ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 17/38] scsi: megaraid: Fix error check return value of register_chrdev() Sasha Levin
2022-05-30 13:49 ` Sasha Levin [this message]
2022-05-30 13:49   ` [PATCH AUTOSEL 4.19 18/38] drm/plane: Move range check for format_count earlier Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 19/38] drm/amd/pm: fix the compile warning Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 20/38] ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 21/38] ASoC: dapm: Don't fold register value changes into notifications Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 22/38] mlxsw: spectrum_dcb: Do not warn about priority changes Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 23/38] ASoC: tscs454: Add endianness flag in snd_soc_component_driver Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 24/38] net: remove two BUG() from skb_checksum_help() Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 25/38] s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 26/38] dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 27/38] ipmi:ssif: Check for NULL msg when handling events and messages Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 28/38] rtlwifi: Use pr_warn instead of WARN_ONCE Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 29/38] media: cec-adap.c: fix is_configuring state Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 30/38] openrisc: start CPU timer early in boot Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 31/38] nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 32/38] ASoC: rt5645: Fix errorenous cleanup order Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 33/38] net: phy: micrel: Allow probing without .driver_data Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 34/38] media: exynos4-is: Fix compile warning Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 35/38] ARM: 9201/1: spectre-bhb: rely on linker to emit cross-section literal loads Sasha Levin
2022-05-30 13:49   ` Sasha Levin
2022-05-30 13:52   ` Ard Biesheuvel
2022-05-30 13:52     ` Ard Biesheuvel
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 36/38] hwmon: Make chip parameter for with_info API mandatory Sasha Levin
2022-05-30 14:29   ` Guenter Roeck
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 37/38] rxrpc: Return an error to sendmsg if call failed Sasha Levin
2022-05-30 13:49 ` [PATCH AUTOSEL 4.19 38/38] eth: tg3: silence the GCC 12 array-bounds warning Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220530134924.1936816-18-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=airlied@linux.ie \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=liviu.dudau@arm.com \
    --cc=stable@vger.kernel.org \
    --cc=steven.price@arm.com \
    --cc=tzimmermann@suse.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.