Re: [PATCH] drm/meson: fix NULL pointer dereference in meson_drv_bind_master()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] drm/meson: missing drm_kms_helper_poll_fini() on error in
  meson_drv_bind_master() [1]
--

commit 79a6a19243f321e0c18a04ea82e4aefcdcacddf4
Author: Rand Deeb <rand.sec96@gmail.com>

drm/meson: fix NULL pointer dereference in meson_drv_bind_master()

This commit avoids jumping to free_drm when allocating priv fails in
meson_drv_bind_master(), directly putting the drm device and returning -ENOMEM
so encoder removal helpers are not called with a NULL priv.

> diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
> index 38bf2811d068d..a9b707062b4f6 100644
> --- a/drivers/gpu/drm/meson/meson_drv.c
> +++ b/drivers/gpu/drm/meson/meson_drv.c
> @@ -204,8 +204,8 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
>  
>  	priv = devm_kzalloc_obj(dev, *priv);
>  	if (!priv) {
> -		ret = -ENOMEM;
> -		goto free_drm;
> +		drm_dev_put(drm);
> +		return -ENOMEM;
>  	}
>  	drm->dev_private = priv;
>  	priv->drm = drm;

[Severity: Critical]
This problem wasn't introduced by this patch, but can a failure in
drm_dev_register() cause a use-after-free on
drm->mode_config.output_poll_work [1]?

drivers/gpu/drm/meson/meson_drv.c:meson_drv_bind_master() {
    ...
	drm_kms_helper_poll_init(drm);

	platform_set_drvdata(pdev, priv);

	ret = drm_dev_register(drm, 0);
	if (ret)
		goto uninstall_irq;
    ...
uninstall_irq:
	free_irq(priv->vsync_irq, drm);
}

When drm_dev_register() fails, jumping to uninstall_irq reaches
drm_dev_put() without calling drm_kms_helper_poll_fini(), leaving
output_poll_work active after the drm_device is freed.

[1] https://sashiko.dev/#/bug/linux-e1c69353-dace-476d-bef2-4ab1c205215c

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111091657.598-1-rand.sec96@gmail.com?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic