Re: [PATCH v7 19/19] gpu: drm: meson: Fix DMA segment size limits and maximize allocation boundaries

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Uninitialized pointer dereference in the error handling path of `meson_drv_bind_master`.

Pre-existing issues:
- [High] NULL pointer dereference when `devm_kzalloc` fails to allocate the `priv` structure.
--

--- Patch [19]: [PATCH v7 19/19] gpu: drm: meson: Fix DMA segment size limits and maximize allocation boundaries ---
commit 5509f37f742bf971664f2f0e723c6187dedff8d4
Author: Anand Moon <linux.amoon@gmail.com>

gpu: drm: meson: Fix DMA segment size limits and maximize allocation boundaries

This commit addresses DMA layout configuration constraints by setting a 32-bit
coherent DMA allocation window and maximizing the scatter-gather allocation
segment boundary check constraint.

> diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
> index 49ff9f1f16d32..899e70bca4ce2 100644
> --- a/drivers/gpu/drm/meson/meson_drv.c
> +++ b/drivers/gpu/drm/meson/meson_drv.c
> @@ -202,6 +202,12 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
>  	if (IS_ERR(drm))
>  		return PTR_ERR(drm);
>  
> +	ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
> +	if (ret)
> +		goto free_drm;

[Severity: High]
If dma_set_mask_and_coherent() fails in meson_drv_bind_master(), the code jumps
to the free_drm error path before the priv pointer is allocated and initialized.

Because the free_drm label unconditionally passes priv to encoder removal
functions:

drivers/gpu/drm/meson/meson_drv.c:meson_drv_bind_master() {
...
free_drm:
	drm_dev_put(drm);

	meson_encoder_dsi_remove(priv);
...
}

And meson_encoder_dsi_remove() dereferences priv immediately:

drivers/gpu/drm/meson/meson_encoder_dsi.c:meson_encoder_dsi_remove() {
...
	if (priv->encoders[MESON_ENC_DSI]) {
...
}

Will this result in dereferencing an uninitialized stack pointer?

> +
> +	dma_set_max_seg_size(dev, UINT_MAX);
> +
>  	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
>  	if (!priv) {
>  		ret = -ENOMEM;
>  		goto free_drm;

[Severity: High]
This is a pre-existing issue, but if devm_kzalloc() in meson_drv_bind_master()
fails to allocate priv, it will be set to NULL and the code jumps to free_drm.

Similar to the above issue, this will pass a NULL priv pointer to
meson_encoder_dsi_remove(), which does not check for NULL before dereferencing
it:

drivers/gpu/drm/meson/meson_encoder_dsi.c:meson_encoder_dsi_remove() {
...
	if (priv->encoders[MESON_ENC_DSI]) {
...
}

Will this cause a NULL pointer dereference during an out-of-memory condition?

>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713120840.17427-1-linux.amoon@gmail.com?part=19

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic