From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BAD883506; Mon, 18 Dec 2023 12:47:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fOmOiPfq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A207C433C7; Mon, 18 Dec 2023 12:47:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1702903622; bh=t+KHn+44ovdVq25CC0aFqqHbf+EASmZbq8XDH9VYYxY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fOmOiPfqsKgIVxB9nQL128YKxMCoPKKXYQjO12/zjrT6fj9qyXJjy/drlUsIRjMhM 9Uy45S30hPyip4jaUuqPdbqAG04pl3++zNHTdnCo31zd0fGNYec6gFpiVW0OanwDO6 KGo+mVQeYZ/Ql791o9k2/fJO24ye/zkQb6r4gRrvJRM6aSxg1VjrHR2o2KO3W2iYr/ 6Ro5SQWPY1b7Z/1oT3rClJATdZwGa36cGYWkPxMql4shZmwAAuLjh9GCgc1DEwtQFE /LACGtXBUqAobVaulnB0v5Z4TQu8uxkWV+2UkajptrzGP19ial2iRdEW9NQwnyCaMJ scOR2r8Cl7Gfw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ziqi Zhao , syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com, Harshit Mogalapalli , Maxime Ripard , Sasha Levin , maarten.lankhorst@linux.intel.com, tzimmermann@suse.de, airlied@gmail.com, daniel@ffwll.ch, dri-devel@lists.freedesktop.org Subject: [PATCH AUTOSEL 5.4 3/7] drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Date: Mon, 18 Dec 2023 07:46:48 -0500 Message-ID: <20231218124656.1381949-3-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231218124656.1381949-1-sashal@kernel.org> References: <20231218124656.1381949-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.4.264 Content-Transfer-Encoding: 8bit From: Ziqi Zhao [ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ] The connector_set contains uninitialized values when allocated with kmalloc_array. However, in the "out" branch, the logic assumes that any element in connector_set would be equal to NULL if failed to initialize, which causes the bug reported by Syzbot. The fix is to use an extra variable to keep track of how many connectors are initialized indeed, and use that variable to decrease any refcounts in the "out" branch. Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Signed-off-by: Ziqi Zhao Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Tested-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com Signed-off-by: Maxime Ripard Signed-off-by: Sasha Levin --- drivers/gpu/drm/drm_crtc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 4936e1080e417..38ce608648b0d 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -535,8 +535,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, struct drm_mode_set set; uint32_t __user *set_connectors_ptr; struct drm_modeset_acquire_ctx ctx; - int ret; - int i; + int ret, i, num_connectors; if (!drm_core_check_feature(dev, DRIVER_MODESET)) return -EOPNOTSUPP; @@ -674,6 +673,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, goto out; } + num_connectors = 0; for (i = 0; i < crtc_req->count_connectors; i++) { connector_set[i] = NULL; set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; @@ -694,6 +694,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, connector->name); connector_set[i] = connector; + num_connectors++; } } @@ -702,7 +703,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, set.y = crtc_req->y; set.mode = mode; set.connectors = connector_set; - set.num_connectors = crtc_req->count_connectors; + set.num_connectors = num_connectors; set.fb = fb; if (drm_drv_uses_atomic_modeset(dev)) @@ -715,7 +716,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, drm_framebuffer_put(fb); if (connector_set) { - for (i = 0; i < crtc_req->count_connectors; i++) { + for (i = 0; i < num_connectors; i++) { if (connector_set[i]) drm_connector_put(connector_set[i]); } -- 2.43.0 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3E4B7C46CA2 for ; Mon, 18 Dec 2023 18:46:19 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 976AF10E2D1; Mon, 18 Dec 2023 18:46:13 +0000 (UTC) Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by gabe.freedesktop.org (Postfix) with ESMTPS id 95DD910E1E5 for ; Mon, 18 Dec 2023 18:42:33 +0000 (UTC) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id DC1A760FC8; Mon, 18 Dec 2023 12:47:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A207C433C7; Mon, 18 Dec 2023 12:47:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1702903622; bh=t+KHn+44ovdVq25CC0aFqqHbf+EASmZbq8XDH9VYYxY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fOmOiPfqsKgIVxB9nQL128YKxMCoPKKXYQjO12/zjrT6fj9qyXJjy/drlUsIRjMhM 9Uy45S30hPyip4jaUuqPdbqAG04pl3++zNHTdnCo31zd0fGNYec6gFpiVW0OanwDO6 KGo+mVQeYZ/Ql791o9k2/fJO24ye/zkQb6r4gRrvJRM6aSxg1VjrHR2o2KO3W2iYr/ 6Ro5SQWPY1b7Z/1oT3rClJATdZwGa36cGYWkPxMql4shZmwAAuLjh9GCgc1DEwtQFE /LACGtXBUqAobVaulnB0v5Z4TQu8uxkWV+2UkajptrzGP19ial2iRdEW9NQwnyCaMJ scOR2r8Cl7Gfw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH AUTOSEL 5.4 3/7] drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Date: Mon, 18 Dec 2023 07:46:48 -0500 Message-ID: <20231218124656.1381949-3-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20231218124656.1381949-1-sashal@kernel.org> References: <20231218124656.1381949-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.4.264 Content-Transfer-Encoding: 8bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sasha Levin , tzimmermann@suse.de, Ziqi Zhao , Maxime Ripard , dri-devel@lists.freedesktop.org, Harshit Mogalapalli , syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" From: Ziqi Zhao [ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ] The connector_set contains uninitialized values when allocated with kmalloc_array. However, in the "out" branch, the logic assumes that any element in connector_set would be equal to NULL if failed to initialize, which causes the bug reported by Syzbot. The fix is to use an extra variable to keep track of how many connectors are initialized indeed, and use that variable to decrease any refcounts in the "out" branch. Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Signed-off-by: Ziqi Zhao Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com Tested-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com Signed-off-by: Maxime Ripard Signed-off-by: Sasha Levin --- drivers/gpu/drm/drm_crtc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 4936e1080e417..38ce608648b0d 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -535,8 +535,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, struct drm_mode_set set; uint32_t __user *set_connectors_ptr; struct drm_modeset_acquire_ctx ctx; - int ret; - int i; + int ret, i, num_connectors; if (!drm_core_check_feature(dev, DRIVER_MODESET)) return -EOPNOTSUPP; @@ -674,6 +673,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, goto out; } + num_connectors = 0; for (i = 0; i < crtc_req->count_connectors; i++) { connector_set[i] = NULL; set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; @@ -694,6 +694,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, connector->name); connector_set[i] = connector; + num_connectors++; } } @@ -702,7 +703,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, set.y = crtc_req->y; set.mode = mode; set.connectors = connector_set; - set.num_connectors = crtc_req->count_connectors; + set.num_connectors = num_connectors; set.fb = fb; if (drm_drv_uses_atomic_modeset(dev)) @@ -715,7 +716,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, drm_framebuffer_put(fb); if (connector_set) { - for (i = 0; i < crtc_req->count_connectors; i++) { + for (i = 0; i < num_connectors; i++) { if (connector_set[i]) drm_connector_put(connector_set[i]); } -- 2.43.0