From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= Subject: Re: [PATCH] drm/vmwgfx_kms: Fix potential NULL pointer dereference Date: Tue, 5 Dec 2017 15:30:20 +0200 Message-ID: <20171205133019.GS10981@intel.com> References: <20171204215418.GA23874@embeddedor.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by gabe.freedesktop.org (Postfix) with ESMTPS id 795EB6E54F for ; Tue, 5 Dec 2017 13:30:24 +0000 (UTC) Content-Disposition: inline In-Reply-To: <20171204215418.GA23874@embeddedor.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: "Gustavo A. R. Silva" Cc: Thomas Hellstrom , David Airlie , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, VMware Graphics List-Id: dri-devel@lists.freedesktop.org T24gTW9uLCBEZWMgMDQsIDIwMTcgYXQgMDM6NTQ6MThQTSAtMDYwMCwgR3VzdGF2byBBLiBSLiBT aWx2YSB3cm90ZToKPiBjcnRjX3N0YXRlIGlzIGJlaW5nIG51bGwgY2hlY2tlZCBpbiBhIHByZXZp b3VzIGNvZGUgYmxvY2ssIHdoaWNoIGltcGxpZXMKPiB0aGF0IHN1Y2ggcG9pbnRlciBtaWdodCBi ZSBudWxsLgo+IAo+IGNydGNfc3RhdGUgaXMgZGVyZWZlcmVuY2VkIGluIGRybV9hdG9taWNfaGVs cGVyX2NoZWNrX3BsYW5lX3N0YXRlLCBoZW5jZQo+IHRoZXJlIGlzIGEgcG90ZW50aWFsIG51bGwg cG9pbnRlciBkZXJlZmVyZW5jZS4KClRoaXMgaXMgYSBmYWxzZSBwb3NpdGl2ZS4gZHJtX2F0b21p Y19oZWxwZXJfY2hlY2tfcGxhbmVfc3RhdGUoKSB3aWxsIG5vdApkZXJlZmVyZW5jZSBjcnRjX3N0 YXRlIHdoZW4gcGxhbmVfc3RhdGUtPmNydGMgaXMgTlVMTC4KCj4gCj4gRml4IHRoaXMgYnkgd2Fy bmluZy1vbiBhbmQgcmV0dXJuaW5nIC1FSU5WQUwgaW4gY2FzZSBjcnRjX3N0YXRlIGlzIG51bGwu Cj4gCj4gQWRkcmVzc2VzLUNvdmVyaXR5LUlEOiAxNDYyNDEyICgiRGVyZWZlcmVuY2UgYWZ0ZXIg bnVsbCBjaGVjayIpCj4gRml4ZXM6IGEwMWNiOGJhM2Y2MiAoImRybTogTW92ZSBkcm1fcGxhbmVf aGVscGVyX2NoZWNrX3N0YXRlKCkgaW50byBkcm1fYXRvbWljX2hlbHBlci5jIikKPiBTaWduZWQt b2ZmLWJ5OiBHdXN0YXZvIEEuIFIuIFNpbHZhIDxnYXJzaWx2YUBlbWJlZGRlZG9yLmNvbT4KPiAt LS0KPiAgZHJpdmVycy9ncHUvZHJtL3Ztd2dmeC92bXdnZnhfa21zLmMgfCAzICsrKwo+ICAxIGZp bGUgY2hhbmdlZCwgMyBpbnNlcnRpb25zKCspCj4gCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1 L2RybS92bXdnZngvdm13Z2Z4X2ttcy5jIGIvZHJpdmVycy9ncHUvZHJtL3Ztd2dmeC92bXdnZnhf a21zLmMKPiBpbmRleCBhMmE5M2Q3Li43MmMzYjI5MCAxMDA2NDQKPiAtLS0gYS9kcml2ZXJzL2dw dS9kcm0vdm13Z2Z4L3Ztd2dmeF9rbXMuYwo+ICsrKyBiL2RyaXZlcnMvZ3B1L2RybS92bXdnZngv dm13Z2Z4X2ttcy5jCj4gQEAgLTQ1NCw2ICs0NTQsOSBAQCBpbnQgdm13X2R1X3ByaW1hcnlfcGxh bmVfYXRvbWljX2NoZWNrKHN0cnVjdCBkcm1fcGxhbmUgKnBsYW5lLAo+ICAJCWNsaXAueTIgPSBj cnRjX3N0YXRlLT5hZGp1c3RlZF9tb2RlLnZkaXNwbGF5Owo+ICAJfQo+ICAKPiArCWlmIChXQVJO X09OKCFjcnRjX3N0YXRlKSkKPiArCQlyZXR1cm4gLUVJTlZBTDsKClRoaXMgd291bGQgaW4gZmFj dCBicmVhayB0aGUgZHJpdmVyIGJlY2F1c2UgaXQgd291bGQgZmxhZyBhbiBlcnJvcgp3aGVuZXZl ciB0aGUgcGxhbmUgaXMgZGlzYWJsZWQuCgo+ICsKPiAgCXJldCA9IGRybV9hdG9taWNfaGVscGVy X2NoZWNrX3BsYW5lX3N0YXRlKHN0YXRlLCBjcnRjX3N0YXRlLCAmY2xpcCwKPiAgCQkJCQkJICBE Uk1fUExBTkVfSEVMUEVSX05PX1NDQUxJTkcsCj4gIAkJCQkJCSAgRFJNX1BMQU5FX0hFTFBFUl9O T19TQ0FMSU5HLAo+IC0tIAo+IDIuNy40Cj4gCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KPiBkcmktZGV2ZWwgbWFpbGluZyBsaXN0Cj4gZHJpLWRldmVs QGxpc3RzLmZyZWVkZXNrdG9wLm9yZwo+IGh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21h aWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCgotLSAKVmlsbGUgU3lyasOkbMOkCkludGVsIE9UQwpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpkcmktZGV2ZWwg bWFpbGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cHM6Ly9saXN0 cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752980AbdLENaZ (ORCPT ); Tue, 5 Dec 2017 08:30:25 -0500 Received: from mga05.intel.com ([192.55.52.43]:42470 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752713AbdLENaY (ORCPT ); Tue, 5 Dec 2017 08:30:24 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,364,1508828400"; d="scan'208";a="1252110108" Date: Tue, 5 Dec 2017 15:30:20 +0200 From: Ville =?iso-8859-1?Q?Syrj=E4l=E4?= To: "Gustavo A. R. Silva" Cc: VMware Graphics , Sinclair Yeh , Thomas Hellstrom , David Airlie , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/vmwgfx_kms: Fix potential NULL pointer dereference Message-ID: <20171205133019.GS10981@intel.com> References: <20171204215418.GA23874@embeddedor.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20171204215418.GA23874@embeddedor.com> User-Agent: Mutt/1.7.2 (2016-11-26) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Dec 04, 2017 at 03:54:18PM -0600, Gustavo A. R. Silva wrote: > crtc_state is being null checked in a previous code block, which implies > that such pointer might be null. > > crtc_state is dereferenced in drm_atomic_helper_check_plane_state, hence > there is a potential null pointer dereference. This is a false positive. drm_atomic_helper_check_plane_state() will not dereference crtc_state when plane_state->crtc is NULL. > > Fix this by warning-on and returning -EINVAL in case crtc_state is null. > > Addresses-Coverity-ID: 1462412 ("Dereference after null check") > Fixes: a01cb8ba3f62 ("drm: Move drm_plane_helper_check_state() into drm_atomic_helper.c") > Signed-off-by: Gustavo A. R. Silva > --- > drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c > index a2a93d7..72c3b290 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c > @@ -454,6 +454,9 @@ int vmw_du_primary_plane_atomic_check(struct drm_plane *plane, > clip.y2 = crtc_state->adjusted_mode.vdisplay; > } > > + if (WARN_ON(!crtc_state)) > + return -EINVAL; This would in fact break the driver because it would flag an error whenever the plane is disabled. > + > ret = drm_atomic_helper_check_plane_state(state, crtc_state, &clip, > DRM_PLANE_HELPER_NO_SCALING, > DRM_PLANE_HELPER_NO_SCALING, > -- > 2.7.4 > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel -- Ville Syrjälä Intel OTC