* [PATCH] video: fbdev: sis: fix null ptr dereference
@ 2020-08-05 14:52 ` trix
0 siblings, 0 replies; 6+ messages in thread
From: trix @ 2020-08-05 14:52 UTC (permalink / raw)
To: thomas, b.zolnierkie, akpm; +Cc: dri-devel, linux-fbdev, linux-kernel, Tom Rix
From: Tom Rix <trix@redhat.com>
Clang static analysis reports this representative error
init.c:2501:18: warning: Array access (from variable 'queuedata') results
in a null pointer dereference
templ |= ((queuedata[i] & 0xc0) << 3);
This is the problem block of code
if(ModeNo > 0x13) {
...
if(SiS_Pr->ChipType == SIS_730) {
queuedata = &FQBQData730[0];
} else {
queuedata = &FQBQData[0];
}
} else {
}
queuedata is not set in the else block
Reviewing the old code, the arrays FQBQData730 and FQBQData were
used directly.
So hoist the setting of queuedata out of the if-else block.
Fixes: 544393fe584d ("[PATCH] sisfb update")
Signed-off-by: Tom Rix <trix@redhat.com>
---
drivers/video/fbdev/sis/init.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
index dfe3eb769638..fde27feae5d0 100644
--- a/drivers/video/fbdev/sis/init.c
+++ b/drivers/video/fbdev/sis/init.c
@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
i = 0;
+ if (SiS_Pr->ChipType == SIS_730)
+ queuedata = &FQBQData730[0];
+ else
+ queuedata = &FQBQData[0];
+
if(ModeNo > 0x13) {
/* Get VCLK */
@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
/* Get half colordepth */
colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
- if(SiS_Pr->ChipType == SIS_730) {
- queuedata = &FQBQData730[0];
- } else {
- queuedata = &FQBQData[0];
- }
-
do {
templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
--
2.18.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH] video: fbdev: sis: fix null ptr dereference
@ 2020-08-05 14:52 ` trix
0 siblings, 0 replies; 6+ messages in thread
From: trix @ 2020-08-05 14:52 UTC (permalink / raw)
To: thomas, b.zolnierkie, akpm; +Cc: Tom Rix, linux-fbdev, linux-kernel, dri-devel
From: Tom Rix <trix@redhat.com>
Clang static analysis reports this representative error
init.c:2501:18: warning: Array access (from variable 'queuedata') results
in a null pointer dereference
templ |= ((queuedata[i] & 0xc0) << 3);
This is the problem block of code
if(ModeNo > 0x13) {
...
if(SiS_Pr->ChipType = SIS_730) {
queuedata = &FQBQData730[0];
} else {
queuedata = &FQBQData[0];
}
} else {
}
queuedata is not set in the else block
Reviewing the old code, the arrays FQBQData730 and FQBQData were
used directly.
So hoist the setting of queuedata out of the if-else block.
Fixes: 544393fe584d ("[PATCH] sisfb update")
Signed-off-by: Tom Rix <trix@redhat.com>
---
drivers/video/fbdev/sis/init.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
index dfe3eb769638..fde27feae5d0 100644
--- a/drivers/video/fbdev/sis/init.c
+++ b/drivers/video/fbdev/sis/init.c
@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
i = 0;
+ if (SiS_Pr->ChipType = SIS_730)
+ queuedata = &FQBQData730[0];
+ else
+ queuedata = &FQBQData[0];
+
if(ModeNo > 0x13) {
/* Get VCLK */
@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
/* Get half colordepth */
colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
- if(SiS_Pr->ChipType = SIS_730) {
- queuedata = &FQBQData730[0];
- } else {
- queuedata = &FQBQData[0];
- }
-
do {
templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
--
2.18.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH] video: fbdev: sis: fix null ptr dereference
@ 2020-08-05 14:52 ` trix
0 siblings, 0 replies; 6+ messages in thread
From: trix @ 2020-08-05 14:52 UTC (permalink / raw)
To: thomas, b.zolnierkie, akpm; +Cc: Tom Rix, linux-fbdev, linux-kernel, dri-devel
From: Tom Rix <trix@redhat.com>
Clang static analysis reports this representative error
init.c:2501:18: warning: Array access (from variable 'queuedata') results
in a null pointer dereference
templ |= ((queuedata[i] & 0xc0) << 3);
This is the problem block of code
if(ModeNo > 0x13) {
...
if(SiS_Pr->ChipType == SIS_730) {
queuedata = &FQBQData730[0];
} else {
queuedata = &FQBQData[0];
}
} else {
}
queuedata is not set in the else block
Reviewing the old code, the arrays FQBQData730 and FQBQData were
used directly.
So hoist the setting of queuedata out of the if-else block.
Fixes: 544393fe584d ("[PATCH] sisfb update")
Signed-off-by: Tom Rix <trix@redhat.com>
---
drivers/video/fbdev/sis/init.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
index dfe3eb769638..fde27feae5d0 100644
--- a/drivers/video/fbdev/sis/init.c
+++ b/drivers/video/fbdev/sis/init.c
@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
i = 0;
+ if (SiS_Pr->ChipType == SIS_730)
+ queuedata = &FQBQData730[0];
+ else
+ queuedata = &FQBQData[0];
+
if(ModeNo > 0x13) {
/* Get VCLK */
@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
/* Get half colordepth */
colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
- if(SiS_Pr->ChipType == SIS_730) {
- queuedata = &FQBQData730[0];
- } else {
- queuedata = &FQBQData[0];
- }
-
do {
templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
--
2.18.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] video: fbdev: sis: fix null ptr dereference
2020-08-05 14:52 ` trix
(?)
@ 2020-09-08 11:37 ` Bartlomiej Zolnierkiewicz
-1 siblings, 0 replies; 6+ messages in thread
From: Bartlomiej Zolnierkiewicz @ 2020-09-08 11:37 UTC (permalink / raw)
To: trix; +Cc: thomas, akpm, dri-devel, linux-fbdev, linux-kernel
On 8/5/20 4:52 PM, trix@redhat.com wrote:
> From: Tom Rix <trix@redhat.com>
>
> Clang static analysis reports this representative error
>
> init.c:2501:18: warning: Array access (from variable 'queuedata') results
> in a null pointer dereference
> templ |= ((queuedata[i] & 0xc0) << 3);
>
> This is the problem block of code
>
> if(ModeNo > 0x13) {
> ...
> if(SiS_Pr->ChipType == SIS_730) {
> queuedata = &FQBQData730[0];
> } else {
> queuedata = &FQBQData[0];
> }
> } else {
>
> }
>
> queuedata is not set in the else block
>
> Reviewing the old code, the arrays FQBQData730 and FQBQData were
> used directly.
>
> So hoist the setting of queuedata out of the if-else block.
>
> Fixes: 544393fe584d ("[PATCH] sisfb update")
>
> Signed-off-by: Tom Rix <trix@redhat.com>
Applied to drm-misc-next tree, thanks.
Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics
> ---
> drivers/video/fbdev/sis/init.c | 11 +++++------
> 1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
> index dfe3eb769638..fde27feae5d0 100644
> --- a/drivers/video/fbdev/sis/init.c
> +++ b/drivers/video/fbdev/sis/init.c
> @@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
>
> i = 0;
>
> + if (SiS_Pr->ChipType == SIS_730)
> + queuedata = &FQBQData730[0];
> + else
> + queuedata = &FQBQData[0];
> +
> if(ModeNo > 0x13) {
>
> /* Get VCLK */
> @@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
> /* Get half colordepth */
> colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
>
> - if(SiS_Pr->ChipType == SIS_730) {
> - queuedata = &FQBQData730[0];
> - } else {
> - queuedata = &FQBQData[0];
> - }
> -
> do {
> templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] video: fbdev: sis: fix null ptr dereference
@ 2020-09-08 11:37 ` Bartlomiej Zolnierkiewicz
0 siblings, 0 replies; 6+ messages in thread
From: Bartlomiej Zolnierkiewicz @ 2020-09-08 11:37 UTC (permalink / raw)
To: trix; +Cc: akpm, linux-fbdev, thomas, linux-kernel, dri-devel
On 8/5/20 4:52 PM, trix@redhat.com wrote:
> From: Tom Rix <trix@redhat.com>
>
> Clang static analysis reports this representative error
>
> init.c:2501:18: warning: Array access (from variable 'queuedata') results
> in a null pointer dereference
> templ |= ((queuedata[i] & 0xc0) << 3);
>
> This is the problem block of code
>
> if(ModeNo > 0x13) {
> ...
> if(SiS_Pr->ChipType = SIS_730) {
> queuedata = &FQBQData730[0];
> } else {
> queuedata = &FQBQData[0];
> }
> } else {
>
> }
>
> queuedata is not set in the else block
>
> Reviewing the old code, the arrays FQBQData730 and FQBQData were
> used directly.
>
> So hoist the setting of queuedata out of the if-else block.
>
> Fixes: 544393fe584d ("[PATCH] sisfb update")
>
> Signed-off-by: Tom Rix <trix@redhat.com>
Applied to drm-misc-next tree, thanks.
Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics
> ---
> drivers/video/fbdev/sis/init.c | 11 +++++------
> 1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
> index dfe3eb769638..fde27feae5d0 100644
> --- a/drivers/video/fbdev/sis/init.c
> +++ b/drivers/video/fbdev/sis/init.c
> @@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
>
> i = 0;
>
> + if (SiS_Pr->ChipType = SIS_730)
> + queuedata = &FQBQData730[0];
> + else
> + queuedata = &FQBQData[0];
> +
> if(ModeNo > 0x13) {
>
> /* Get VCLK */
> @@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
> /* Get half colordepth */
> colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
>
> - if(SiS_Pr->ChipType = SIS_730) {
> - queuedata = &FQBQData730[0];
> - } else {
> - queuedata = &FQBQData[0];
> - }
> -
> do {
> templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] video: fbdev: sis: fix null ptr dereference
@ 2020-09-08 11:37 ` Bartlomiej Zolnierkiewicz
0 siblings, 0 replies; 6+ messages in thread
From: Bartlomiej Zolnierkiewicz @ 2020-09-08 11:37 UTC (permalink / raw)
To: trix; +Cc: akpm, linux-fbdev, thomas, linux-kernel, dri-devel
On 8/5/20 4:52 PM, trix@redhat.com wrote:
> From: Tom Rix <trix@redhat.com>
>
> Clang static analysis reports this representative error
>
> init.c:2501:18: warning: Array access (from variable 'queuedata') results
> in a null pointer dereference
> templ |= ((queuedata[i] & 0xc0) << 3);
>
> This is the problem block of code
>
> if(ModeNo > 0x13) {
> ...
> if(SiS_Pr->ChipType == SIS_730) {
> queuedata = &FQBQData730[0];
> } else {
> queuedata = &FQBQData[0];
> }
> } else {
>
> }
>
> queuedata is not set in the else block
>
> Reviewing the old code, the arrays FQBQData730 and FQBQData were
> used directly.
>
> So hoist the setting of queuedata out of the if-else block.
>
> Fixes: 544393fe584d ("[PATCH] sisfb update")
>
> Signed-off-by: Tom Rix <trix@redhat.com>
Applied to drm-misc-next tree, thanks.
Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics
> ---
> drivers/video/fbdev/sis/init.c | 11 +++++------
> 1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
> index dfe3eb769638..fde27feae5d0 100644
> --- a/drivers/video/fbdev/sis/init.c
> +++ b/drivers/video/fbdev/sis/init.c
> @@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
>
> i = 0;
>
> + if (SiS_Pr->ChipType == SIS_730)
> + queuedata = &FQBQData730[0];
> + else
> + queuedata = &FQBQData[0];
> +
> if(ModeNo > 0x13) {
>
> /* Get VCLK */
> @@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
> /* Get half colordepth */
> colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
>
> - if(SiS_Pr->ChipType == SIS_730) {
> - queuedata = &FQBQData730[0];
> - } else {
> - queuedata = &FQBQData[0];
> - }
> -
> do {
> templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
>
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-09-08 13:02 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20200805145226eucas1p1e0e6d9fa3c05f7e247365f0db17cbe38@eucas1p1.samsung.com>
2020-08-05 14:52 ` [PATCH] video: fbdev: sis: fix null ptr dereference trix
2020-08-05 14:52 ` trix
2020-08-05 14:52 ` trix
2020-09-08 11:37 ` Bartlomiej Zolnierkiewicz
2020-09-08 11:37 ` Bartlomiej Zolnierkiewicz
2020-09-08 11:37 ` Bartlomiej Zolnierkiewicz
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.