Re: [PATCH] drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to unsafe access to `connector->state` in the fallback logic without proper locking or addition to the atomic state.
- [Medium] Iterator variable `connector_state` leaks from the `for_each_new_connector_in_state` loop when no CRTC-bound connector is found, causing the wrong connector state to be used.
--

commit 0c2e0cfd22b820fc8dacf39a623bb3f5f21ff275
Author: Sajal Gupta <sajal2005gupta@gmail.com>

drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

This commit fixes an out-of-bounds write in the plane property loop of
gud_plane_atomic_check(). It drops a redundant addition of the loop index
to num_properties, since num_properties is already the correct running
index.

Link: https://sashiko.dev/#/patchset/20260821071812.16500-1-sajal2005gupta%40gmail.com?part=1

> diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
> index 5ef887d8485a3..54adc401bc1ba 100644
> --- a/drivers/gpu/drm/gud/gud_pipe.c
> +++ b/drivers/gpu/drm/gud/gud_pipe.c

[ ... ]

> @@ -562,8 +562,8 @@ int gud_plane_atomic_check(struct drm_plane *plane,
>  			goto out;
>  		}
>  
> -		req->properties[num_properties + i].prop = cpu_to_le16(prop);
> -		req->properties[num_properties + i].val = cpu_to_le64(val);
> +		req->properties[num_properties].prop = cpu_to_le16(prop);
> +		req->properties[num_properties].val = cpu_to_le64(val);
>  		num_properties++;
>  	}

While reviewing this change, I noticed a couple of pre-existing issues earlier
in gud_plane_atomic_check():

drivers/gpu/drm/gud/gud_pipe.c:gud_plane_atomic_check() {
    ...
    for_each_new_connector_in_state(state, connector, connector_state, i) {
        if (connector_state->crtc)
            break;
    }

    /*
     * DRM_IOCTL_MODE_OBJ_SETPROPERTY on the rotation property will not have
     * the connector included in the state.
     */
    if (!connector_state) {

[Severity: Medium]
This is a pre-existing issue, but I noticed the iterator variable
connector_state is not cleared if the loop completes without hitting the
break statement.

If userspace submits an atomic commit updating a plane property while
simultaneously modifying a disconnected connector, the loop evaluates the
disconnected connector and finishes without breaking. This leaves
connector_state retaining the disconnected state.

Since connector_state is no longer NULL, the fallback check is skipped.
Could this cause the hardware check command GUD_REQ_SET_STATE_CHECK to
receive the ID of a disconnected connector and misconfigure the display?

        struct drm_connector_list_iter conn_iter;

        drm_connector_list_iter_begin(plane->dev, &conn_iter);
        drm_for_each_connector_iter(connector, &conn_iter) {
            if (connector->state->crtc) {
                connector_state = connector->state;
                break;
            }
        }
        drm_connector_list_iter_end(&conn_iter);
    }

[Severity: High]
This is also a pre-existing issue, but does this fallback logic risk a
use-after-free by directly accessing connector->state?

When an atomic commit updates only a plane property, the fallback logic
iterates all system connectors and directly assigns connector_state to
connector->state. Because the connector is not added to the atomic state
via drm_atomic_get_connector_state(), its lock is not held by the current
thread.

If a concurrent userspace thread issues a property update on this connector,
could it swap and free the old state while gud_connector_fill_properties()
is simultaneously reading from it?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902123254.36987-1-sajal2005gupta@gmail.com?part=1