From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFD9CC433B4 for ; Wed, 31 Mar 2021 17:33:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B64E860BD3 for ; Wed, 31 Mar 2021 17:33:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229787AbhCaRcg (ORCPT ); Wed, 31 Mar 2021 13:32:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:43332 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229615AbhCaRcJ (ORCPT ); Wed, 31 Mar 2021 13:32:09 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 65B3F6100A; Wed, 31 Mar 2021 17:32:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1617211929; bh=R6hdUWDOSIo+l+ZPLsXFD7/GO3a//15OerumDzH+MCI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=Ws4NneA9cCNtMpAPsh7LyxzNjHyj7eH5GVbMpg1JHtA+fzG1naeJYuaYEgdW+HDT8 8uCnoLFnIvC/dK5kwMzB36wB3WcBqGWXuQCtQWgX8v9hzNiEOV4C8QV62AUw6x9RBc peMRvv/ZZ+ZrNuEWNQ3FBHMZRCcUJI+3lakFvwy0= Date: Wed, 31 Mar 2021 19:32:06 +0200 From: Greg KH To: Hassan Shahbazi Cc: daniel.vetter@ffwll.ch, jirislaby@kernel.org, yepeilin.cs@gmail.com, linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] fix NULL pointer deference crash Message-ID: References: <20210331163425.8092-1-h.shahbazi.git@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210331163425.8092-1-h.shahbazi.git@gmail.com> Precedence: bulk List-ID: X-Mailing-List: linux-fbdev@vger.kernel.org On Wed, Mar 31, 2021 at 07:34:29PM +0300, Hassan Shahbazi wrote: > The patch has fixed a NULL pointer deference crash in hiding the cursor. It > is verified by syzbot patch tester. > > Reported by: syzbot > https://syzkaller.appspot.com/bug?id=defb47bf56e1c14d5687280c7bb91ce7b608b94b > > Signed-off-by: Hassan Shahbazi > --- > drivers/video/fbdev/core/fbcon.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c > index 44a5cd2f54cc..ee252d1c43c6 100644 > --- a/drivers/video/fbdev/core/fbcon.c > +++ b/drivers/video/fbdev/core/fbcon.c > @@ -1333,8 +1333,9 @@ static void fbcon_cursor(struct vc_data *vc, int mode) > > ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1; > > - ops->cursor(vc, info, mode, get_color(vc, info, c, 1), > - get_color(vc, info, c, 0)); > + if (ops && ops->cursor) As ops obviously is not NULL here (you just used it on the line above), why are you checking it again? And what makes curser be NULL here? How can that happen? Also your subject line can use some work, please make it reflect the driver subsystem you are looking at. thanks, greg k-h From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23785C433ED for ; Wed, 31 Mar 2021 17:32:11 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B24C36100A for ; Wed, 31 Mar 2021 17:32:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B24C36100A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D080C6EB2A; Wed, 31 Mar 2021 17:32:09 +0000 (UTC) Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2E7FE6EB2A for ; Wed, 31 Mar 2021 17:32:09 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id 65B3F6100A; Wed, 31 Mar 2021 17:32:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1617211929; bh=R6hdUWDOSIo+l+ZPLsXFD7/GO3a//15OerumDzH+MCI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=Ws4NneA9cCNtMpAPsh7LyxzNjHyj7eH5GVbMpg1JHtA+fzG1naeJYuaYEgdW+HDT8 8uCnoLFnIvC/dK5kwMzB36wB3WcBqGWXuQCtQWgX8v9hzNiEOV4C8QV62AUw6x9RBc peMRvv/ZZ+ZrNuEWNQ3FBHMZRCcUJI+3lakFvwy0= Date: Wed, 31 Mar 2021 19:32:06 +0200 From: Greg KH To: Hassan Shahbazi Subject: Re: [PATCH] fix NULL pointer deference crash Message-ID: References: <20210331163425.8092-1-h.shahbazi.git@gmail.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20210331163425.8092-1-h.shahbazi.git@gmail.com> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-fbdev@vger.kernel.org, daniel.vetter@ffwll.ch, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, jirislaby@kernel.org, yepeilin.cs@gmail.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Wed, Mar 31, 2021 at 07:34:29PM +0300, Hassan Shahbazi wrote: > The patch has fixed a NULL pointer deference crash in hiding the cursor. It > is verified by syzbot patch tester. > > Reported by: syzbot > https://syzkaller.appspot.com/bug?id=defb47bf56e1c14d5687280c7bb91ce7b608b94b > > Signed-off-by: Hassan Shahbazi > --- > drivers/video/fbdev/core/fbcon.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c > index 44a5cd2f54cc..ee252d1c43c6 100644 > --- a/drivers/video/fbdev/core/fbcon.c > +++ b/drivers/video/fbdev/core/fbcon.c > @@ -1333,8 +1333,9 @@ static void fbcon_cursor(struct vc_data *vc, int mode) > > ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1; > > - ops->cursor(vc, info, mode, get_color(vc, info, c, 1), > - get_color(vc, info, c, 0)); > + if (ops && ops->cursor) As ops obviously is not NULL here (you just used it on the line above), why are you checking it again? And what makes curser be NULL here? How can that happen? Also your subject line can use some work, please make it reflect the driver subsystem you are looking at. thanks, greg k-h _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel