From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Joshua Aberback <Joshua.Aberback@amd.com>,
Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>,
amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
Alex Deucher <alexander.deucher@amd.com>
Subject: [PATCH AUTOSEL 5.4 061/108] drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic
Date: Sat, 11 Apr 2020 19:08:56 -0400 [thread overview]
Message-ID: <20200411230943.24951-61-sashal@kernel.org> (raw)
In-Reply-To: <20200411230943.24951-1-sashal@kernel.org>
From: Aric Cyr <aric.cyr@amd.com>
[ Upstream commit 6a6c4a4d459ecacc9013c45dcbf2bc9747fdbdbd ]
[Why]
Since the i2c payload allocation can fail need to check return codes
[How]
Clean up i2c payload allocations and check for errors
Signed-off-by: Aric Cyr <aric.cyr@amd.com>
Reviewed-by: Joshua Aberback <Joshua.Aberback@amd.com>
Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/display/dc/core/dc_link_ddc.c | 52 +++++++++----------
1 file changed, 25 insertions(+), 27 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
index 51991bf26a93c..4c90d68db2307 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_ddc.c
@@ -126,22 +126,16 @@ struct aux_payloads {
struct vector payloads;
};
-static struct i2c_payloads *dal_ddc_i2c_payloads_create(struct dc_context *ctx, uint32_t count)
+static bool dal_ddc_i2c_payloads_create(
+ struct dc_context *ctx,
+ struct i2c_payloads *payloads,
+ uint32_t count)
{
- struct i2c_payloads *payloads;
-
- payloads = kzalloc(sizeof(struct i2c_payloads), GFP_KERNEL);
-
- if (!payloads)
- return NULL;
-
if (dal_vector_construct(
&payloads->payloads, ctx, count, sizeof(struct i2c_payload)))
- return payloads;
-
- kfree(payloads);
- return NULL;
+ return true;
+ return false;
}
static struct i2c_payload *dal_ddc_i2c_payloads_get(struct i2c_payloads *p)
@@ -154,14 +148,12 @@ static uint32_t dal_ddc_i2c_payloads_get_count(struct i2c_payloads *p)
return p->payloads.count;
}
-static void dal_ddc_i2c_payloads_destroy(struct i2c_payloads **p)
+static void dal_ddc_i2c_payloads_destroy(struct i2c_payloads *p)
{
- if (!p || !*p)
+ if (!p)
return;
- dal_vector_destruct(&(*p)->payloads);
- kfree(*p);
- *p = NULL;
+ dal_vector_destruct(&p->payloads);
}
#define DDC_MIN(a, b) (((a) < (b)) ? (a) : (b))
@@ -521,9 +513,13 @@ bool dal_ddc_service_query_ddc_data(
uint32_t payloads_num = write_payloads + read_payloads;
+
if (write_size > EDID_SEGMENT_SIZE || read_size > EDID_SEGMENT_SIZE)
return false;
+ if (!payloads_num)
+ return false;
+
/*TODO: len of payload data for i2c and aux is uint8!!!!,
* but we want to read 256 over i2c!!!!*/
if (dal_ddc_service_is_in_aux_transaction_mode(ddc)) {
@@ -556,23 +552,25 @@ bool dal_ddc_service_query_ddc_data(
ret = dc_link_aux_transfer_with_retries(ddc, &read_payload);
} else {
- struct i2c_payloads *payloads =
- dal_ddc_i2c_payloads_create(ddc->ctx, payloads_num);
+ struct i2c_command command = {0};
+ struct i2c_payloads payloads;
+
+ if (!dal_ddc_i2c_payloads_create(ddc->ctx, &payloads, payloads_num))
+ return false;
- struct i2c_command command = {
- .payloads = dal_ddc_i2c_payloads_get(payloads),
- .number_of_payloads = 0,
- .engine = DDC_I2C_COMMAND_ENGINE,
- .speed = ddc->ctx->dc->caps.i2c_speed_in_khz };
+ command.payloads = dal_ddc_i2c_payloads_get(&payloads);
+ command.number_of_payloads = 0;
+ command.engine = DDC_I2C_COMMAND_ENGINE;
+ command.speed = ddc->ctx->dc->caps.i2c_speed_in_khz;
dal_ddc_i2c_payloads_add(
- payloads, address, write_size, write_buf, true);
+ &payloads, address, write_size, write_buf, true);
dal_ddc_i2c_payloads_add(
- payloads, address, read_size, read_buf, false);
+ &payloads, address, read_size, read_buf, false);
command.number_of_payloads =
- dal_ddc_i2c_payloads_get_count(payloads);
+ dal_ddc_i2c_payloads_get_count(&payloads);
ret = dm_helpers_submit_i2c(
ddc->ctx,
--
2.20.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2020-04-11 23:11 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200411230943.24951-1-sashal@kernel.org>
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 012/108] drm/amd/display: Explicitly disable triplebuffer flips Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 022/108] drm/tegra: dc: Release PM and RGB output when client's registration fails Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 024/108] drm/amd/display: Stop if retimer is not available Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 026/108] drm/amd/display: writing stereo polarity register if swapped Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 029/108] drm/amd/display: Fix default logger mask definition Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 032/108] drm/amd/display: Only round InfoFrame refresh rates Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 042/108] drm/sun4i: dsi: Use NULL to signify "no panel" Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 048/108] drm/omap: fix possible object reference leak Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 051/108] drm/stm: ltdc: check crtc state before enabling LIE Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 052/108] fbdev: potential information leak in do_fb_ioctl() Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 053/108] drm/crc: Actually allow to change the crc source Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 054/108] drm/amdgpu: fix parentheses in amdgpu_vm_update_ptes Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 055/108] drm/amd/display: dc_get_vmid_use_vector() crashes when get called Sasha Levin
2020-04-11 23:08 ` Sasha Levin [this message]
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 062/108] drm/amd/display: System crashes when add_ptb_to_table() gets called Sasha Levin
2020-04-11 23:08 ` [PATCH AUTOSEL 5.4 063/108] drm/omap: dss: Cleanup DSS ports on initialisation failure Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 072/108] drm/msm: fix leaks if initialization fails Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 073/108] drm/msm/a5xx: Always set an OPP supported hardware value Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 074/108] drm/msm: devcoredump should dump MSM_SUBMIT_BO_DUMP buffers Sasha Levin
2020-04-11 23:09 ` [PATCH AUTOSEL 5.4 108/108] PCI: Use ioremap(), not phys_to_virt() for platform ROM Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200411230943.24951-61-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Joshua.Aberback@amd.com \
--cc=Rodrigo.Siqueira@amd.com \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).