All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument
@ 2019-05-15 13:29 Noralf Trønnes
  2019-05-15 13:40 ` Daniel Vetter
  0 siblings, 1 reply; 5+ messages in thread
From: Noralf Trønnes @ 2019-05-15 13:29 UTC (permalink / raw)
  To: dri-devel; +Cc: kbuild test robot, Dan Carpenter

drm_fb_helper_hotplug_event() should tolerate the fb_helper argument being
NULL. Commit 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
introduced a fb_helper dereference before the NULL check.
Fixup by moving the dereference after the NULL check.

Fixes: 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
---
 drivers/gpu/drm/drm_fb_helper.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index c259a28522f8..a52b48fafbd7 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -3031,7 +3031,6 @@ EXPORT_SYMBOL(drm_fb_helper_initial_config);
  */
 int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
 {
-	struct drm_device *dev = fb_helper->dev;
 	int err = 0;
 
 	if (!drm_fbdev_emulation || !fb_helper)
@@ -3044,13 +3043,13 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
 		return err;
 	}
 
-	if (!fb_helper->fb || !drm_master_internal_acquire(dev)) {
+	if (!fb_helper->fb || !drm_master_internal_acquire(fb_helper->dev)) {
 		fb_helper->delayed_hotplug = true;
 		mutex_unlock(&fb_helper->lock);
 		return err;
 	}
 
-	drm_master_internal_release(dev);
+	drm_master_internal_release(fb_helper->dev);
 
 	DRM_DEBUG_KMS("\n");
 
-- 
2.20.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply related	[flat|nested] 5+ messages in thread
* Re: [PATCH] drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument
  2019-05-15 13:29 [PATCH] drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument Noralf Trønnes
@ 2019-05-15 13:40 ` Daniel Vetter
  2019-05-15 13:55   ` Dan Carpenter
  2019-05-16 10:09   ` Noralf Trønnes
  0 siblings, 2 replies; 5+ messages in thread
From: Daniel Vetter @ 2019-05-15 13:40 UTC (permalink / raw)
  To: Noralf Trønnes; +Cc: Dan Carpenter, kbuild test robot, dri-devel

On Wed, May 15, 2019 at 03:29:25PM +0200, Noralf Trønnes wrote:
> drm_fb_helper_hotplug_event() should tolerate the fb_helper argument being
> NULL. Commit 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
> introduced a fb_helper dereference before the NULL check.
> Fixup by moving the dereference after the NULL check.
> 
> Fixes: 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
> Reported-by: kbuild test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

Ah the classic "I spotted a deref before your NULL check, I'm going to
optimize this all away because you got it wrong" nonsense from gcc. I
thought the kernel uses a special compile flag to avoid this optimization
...

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

> ---
>  drivers/gpu/drm/drm_fb_helper.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
> index c259a28522f8..a52b48fafbd7 100644
> --- a/drivers/gpu/drm/drm_fb_helper.c
> +++ b/drivers/gpu/drm/drm_fb_helper.c
> @@ -3031,7 +3031,6 @@ EXPORT_SYMBOL(drm_fb_helper_initial_config);
>   */
>  int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
>  {
> -	struct drm_device *dev = fb_helper->dev;
>  	int err = 0;
>  
>  	if (!drm_fbdev_emulation || !fb_helper)
> @@ -3044,13 +3043,13 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
>  		return err;
>  	}
>  
> -	if (!fb_helper->fb || !drm_master_internal_acquire(dev)) {
> +	if (!fb_helper->fb || !drm_master_internal_acquire(fb_helper->dev)) {
>  		fb_helper->delayed_hotplug = true;
>  		mutex_unlock(&fb_helper->lock);
>  		return err;
>  	}
>  
> -	drm_master_internal_release(dev);
> +	drm_master_internal_release(fb_helper->dev);
>  
>  	DRM_DEBUG_KMS("\n");
>  
> -- 
> 2.20.1
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument
  2019-05-15 13:40 ` Daniel Vetter
@ 2019-05-15 13:55   ` Dan Carpenter
  2019-05-15 19:28     ` Daniel Vetter
  2019-05-16 10:09   ` Noralf Trønnes
  1 sibling, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2019-05-15 13:55 UTC (permalink / raw)
  To: Daniel Vetter; +Cc: kbuild test robot, dri-devel

On Wed, May 15, 2019 at 03:40:14PM +0200, Daniel Vetter wrote:
> On Wed, May 15, 2019 at 03:29:25PM +0200, Noralf Trønnes wrote:
> > drm_fb_helper_hotplug_event() should tolerate the fb_helper argument being
> > NULL. Commit 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
> > introduced a fb_helper dereference before the NULL check.
> > Fixup by moving the dereference after the NULL check.
> > 
> > Fixes: 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
> > Reported-by: kbuild test robot <lkp@intel.com>
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
> 
> Ah the classic "I spotted a deref before your NULL check, I'm going to
> optimize this all away because you got it wrong" nonsense from gcc. I
> thought the kernel uses a special compile flag to avoid this optimization
> ...

This is just a normal NULL dereference bug.

You're thinking of the old tun.c vulnerability.  That was back in the
day before we started using -fno-delete-null-pointer-checks.  What
happened there was the code should have NULL dereferenced and Oopsed but
GCC optimized it away and it ended up being a privilege escalation bug
instead.

regards,
dan carpenter

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument
  2019-05-15 13:55   ` Dan Carpenter
@ 2019-05-15 19:28     ` Daniel Vetter
  0 siblings, 0 replies; 5+ messages in thread
From: Daniel Vetter @ 2019-05-15 19:28 UTC (permalink / raw)
  To: Dan Carpenter; +Cc: dri-devel, kbuild test robot

On Wed, May 15, 2019 at 04:55:16PM +0300, Dan Carpenter wrote:
> On Wed, May 15, 2019 at 03:40:14PM +0200, Daniel Vetter wrote:
> > On Wed, May 15, 2019 at 03:29:25PM +0200, Noralf Trønnes wrote:
> > > drm_fb_helper_hotplug_event() should tolerate the fb_helper argument being
> > > NULL. Commit 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
> > > introduced a fb_helper dereference before the NULL check.
> > > Fixup by moving the dereference after the NULL check.
> > > 
> > > Fixes: 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
> > > Reported-by: kbuild test robot <lkp@intel.com>
> > > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > > Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
> > 
> > Ah the classic "I spotted a deref before your NULL check, I'm going to
> > optimize this all away because you got it wrong" nonsense from gcc. I
> > thought the kernel uses a special compile flag to avoid this optimization
> > ...
> 
> This is just a normal NULL dereference bug.
> 
> You're thinking of the old tun.c vulnerability.  That was back in the
> day before we started using -fno-delete-null-pointer-checks.  What
> happened there was the code should have NULL dereferenced and Oopsed but
> GCC optimized it away and it ended up being a privilege escalation bug
> instead.

Hm right, I got confused.
-Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument
  2019-05-15 13:40 ` Daniel Vetter
  2019-05-15 13:55   ` Dan Carpenter
@ 2019-05-16 10:09   ` Noralf Trønnes
  1 sibling, 0 replies; 5+ messages in thread
From: Noralf Trønnes @ 2019-05-16 10:09 UTC (permalink / raw)
  To: Daniel Vetter; +Cc: Dan Carpenter, kbuild test robot, dri-devel



Den 15.05.2019 15.40, skrev Daniel Vetter:
> On Wed, May 15, 2019 at 03:29:25PM +0200, Noralf Trønnes wrote:
>> drm_fb_helper_hotplug_event() should tolerate the fb_helper argument being
>> NULL. Commit 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
>> introduced a fb_helper dereference before the NULL check.
>> Fixup by moving the dereference after the NULL check.
>>
>> Fixes: 03a9606e7fee ("drm/fb-helper: Avoid race with DRM userspace")
>> Reported-by: kbuild test robot <lkp@intel.com>
>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>> Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> 

Thanks Dan and Daniel, applied to drm-misc-next.

Noralf.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-05-16 10:09 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-15 13:29 [PATCH] drm/fb-helper: Fix drm_fb_helper_hotplug_event() NULL ptr argument Noralf Trønnes
2019-05-15 13:40 ` Daniel Vetter
2019-05-15 13:55   ` Dan Carpenter
2019-05-15 19:28     ` Daniel Vetter
2019-05-16 10:09   ` Noralf Trønnes

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.