* [PATCH] drm/sun4i: backend: Fix error pointers in sun4i_backend_atomic_check
@ 2025-03-14 1:20 Chenyuan Yang
2025-03-14 7:17 ` Maxime Ripard
0 siblings, 1 reply; 4+ messages in thread
From: Chenyuan Yang @ 2025-03-14 1:20 UTC (permalink / raw)
To: mripard, wens, maarten.lankhorst, tzimmermann, airlied, simona,
jernej.skrabec, samuel, neil.armstrong
Cc: dri-devel, linux-arm-kernel, linux-sunxi, linux-kernel,
Chenyuan Yang
The function sun4i_backend_atomic_check was dereferencing pointers
returned by drm_atomic_get_plane_state without checking for errors. This
could lead to undefined behavior if the function returns an error pointer.
This commit adds checks using IS_ERR to ensure that plane_state is
valid before dereferencing them.
Similar to commit da29abe71e16
("drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed").
Fixes: 96180dde23b7 ("drm/sun4i: backend: Add a custom atomic_check for the frontend")
Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
---
drivers/gpu/drm/sun4i/sun4i_backend.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
index 2dded3b828df..a8e0e2123764 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -490,6 +490,10 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine,
drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) {
struct drm_plane_state *plane_state =
drm_atomic_get_plane_state(state, plane);
+
+ if (IS_ERR(plane_state))
+ return PTR_ERR(plane_state);
+
struct sun4i_layer_state *layer_state =
state_to_sun4i_layer_state(plane_state);
struct drm_framebuffer *fb = plane_state->fb;
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] drm/sun4i: backend: Fix error pointers in sun4i_backend_atomic_check 2025-03-14 1:20 [PATCH] drm/sun4i: backend: Fix error pointers in sun4i_backend_atomic_check Chenyuan Yang @ 2025-03-14 7:17 ` Maxime Ripard 2025-03-14 16:00 ` Chenyuan Yang 0 siblings, 1 reply; 4+ messages in thread From: Maxime Ripard @ 2025-03-14 7:17 UTC (permalink / raw) To: Chenyuan Yang Cc: wens, maarten.lankhorst, tzimmermann, airlied, simona, jernej.skrabec, samuel, neil.armstrong, dri-devel, linux-arm-kernel, linux-sunxi, linux-kernel [-- Attachment #1: Type: text/plain, Size: 1415 bytes --] Hi, On Thu, Mar 13, 2025 at 08:20:29PM -0500, Chenyuan Yang wrote: > The function sun4i_backend_atomic_check was dereferencing pointers > returned by drm_atomic_get_plane_state without checking for errors. This > could lead to undefined behavior if the function returns an error pointer. > > This commit adds checks using IS_ERR to ensure that plane_state is > valid before dereferencing them. > > Similar to commit da29abe71e16 > ("drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed"). > > Fixes: 96180dde23b7 ("drm/sun4i: backend: Add a custom atomic_check for the frontend") > Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com> > --- > drivers/gpu/drm/sun4i/sun4i_backend.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c > index 2dded3b828df..a8e0e2123764 100644 > --- a/drivers/gpu/drm/sun4i/sun4i_backend.c > +++ b/drivers/gpu/drm/sun4i/sun4i_backend.c > @@ -490,6 +490,10 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine, > drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) { > struct drm_plane_state *plane_state = > drm_atomic_get_plane_state(state, plane); > + > + if (IS_ERR(plane_state)) > + return PTR_ERR(plane_state); > + This introduces a build warning. You shouldn't mix declarations and code. Maxime [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 273 bytes --] ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/sun4i: backend: Fix error pointers in sun4i_backend_atomic_check 2025-03-14 7:17 ` Maxime Ripard @ 2025-03-14 16:00 ` Chenyuan Yang 2025-08-07 10:34 ` Dan Carpenter 0 siblings, 1 reply; 4+ messages in thread From: Chenyuan Yang @ 2025-03-14 16:00 UTC (permalink / raw) To: Maxime Ripard Cc: wens, maarten.lankhorst, tzimmermann, airlied, simona, jernej.skrabec, samuel, neil.armstrong, dri-devel, linux-arm-kernel, linux-sunxi, linux-kernel HI Maxime. Thanks so much for pointing that out! How about such a patch? diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c index 2dded3b828df..5ad0e90d3e6b 100644 --- a/drivers/gpu/drm/sun4i/sun4i_backend.c +++ b/drivers/gpu/drm/sun4i/sun4i_backend.c @@ -490,9 +490,14 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine, drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) { struct drm_plane_state *plane_state = drm_atomic_get_plane_state(state, plane); - struct sun4i_layer_state *layer_state = - state_to_sun4i_layer_state(plane_state); - struct drm_framebuffer *fb = plane_state->fb; + struct sun4i_layer_state *layer_state = NULL; + struct drm_framebuffer *fb = NULL; + + if (IS_ERR(plane_state)) + return PTR_ERR(plane_state); + + layer_state = state_to_sun4i_layer_state(plane_state); + fb = plane_state->fb; if (!sun4i_backend_plane_is_supported(plane_state, &layer_state->uses_frontend)) -- -Chenyuan On Fri, Mar 14, 2025 at 2:17 AM Maxime Ripard <mripard@kernel.org> wrote: > > Hi, > > On Thu, Mar 13, 2025 at 08:20:29PM -0500, Chenyuan Yang wrote: > > The function sun4i_backend_atomic_check was dereferencing pointers > > returned by drm_atomic_get_plane_state without checking for errors. This > > could lead to undefined behavior if the function returns an error pointer. > > > > This commit adds checks using IS_ERR to ensure that plane_state is > > valid before dereferencing them. > > > > Similar to commit da29abe71e16 > > ("drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed"). > > > > Fixes: 96180dde23b7 ("drm/sun4i: backend: Add a custom atomic_check for the frontend") > > Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com> > > --- > > drivers/gpu/drm/sun4i/sun4i_backend.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c > > index 2dded3b828df..a8e0e2123764 100644 > > --- a/drivers/gpu/drm/sun4i/sun4i_backend.c > > +++ b/drivers/gpu/drm/sun4i/sun4i_backend.c > > @@ -490,6 +490,10 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine, > > drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) { > > struct drm_plane_state *plane_state = > > drm_atomic_get_plane_state(state, plane); > > + > > + if (IS_ERR(plane_state)) > > + return PTR_ERR(plane_state); > > + > > This introduces a build warning. You shouldn't mix declarations and code. > > Maxime ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/sun4i: backend: Fix error pointers in sun4i_backend_atomic_check 2025-03-14 16:00 ` Chenyuan Yang @ 2025-08-07 10:34 ` Dan Carpenter 0 siblings, 0 replies; 4+ messages in thread From: Dan Carpenter @ 2025-08-07 10:34 UTC (permalink / raw) To: Chenyuan Yang Cc: Maxime Ripard, wens, maarten.lankhorst, tzimmermann, airlied, simona, jernej.skrabec, samuel, neil.armstrong, dri-devel, linux-arm-kernel, linux-sunxi, linux-kernel On Fri, Mar 14, 2025 at 11:00:26AM -0500, Chenyuan Yang wrote: > HI Maxime. > > Thanks so much for pointing that out! > > How about such a patch? > This patch is corrupted so we can't review it. > diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c > b/drivers/gpu/drm/sun4i/sun4i_backend.c > index 2dded3b828df..5ad0e90d3e6b 100644 > --- a/drivers/gpu/drm/sun4i/sun4i_backend.c > +++ b/drivers/gpu/drm/sun4i/sun4i_backend.c > @@ -490,9 +490,14 @@ static int sun4i_backend_atomic_check(struct > sunxi_engine *engine, > drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) { > struct drm_plane_state *plane_state = > drm_atomic_get_plane_state(state, plane); > - struct sun4i_layer_state *layer_state = > - state_to_sun4i_layer_state(plane_state); > - struct drm_framebuffer *fb = plane_state->fb; > + struct sun4i_layer_state *layer_state = NULL; > + struct drm_framebuffer *fb = NULL; No need to initialize things like this. NULL isn't a valid pointer. This just disables static checker tools from finding uninitialized variable warnings so all the expense of writing the checker tools is now wasted. regards, dan carpenter > + > + if (IS_ERR(plane_state)) > + return PTR_ERR(plane_state); > + > + layer_state = state_to_sun4i_layer_state(plane_state); > + fb = plane_state->fb; > > if (!sun4i_backend_plane_is_supported(plane_state, > &layer_state->uses_frontend)) > -- > > -Chenyuan > > On Fri, Mar 14, 2025 at 2:17 AM Maxime Ripard <mripard@kernel.org> wrote: > > > > Hi, > > > > On Thu, Mar 13, 2025 at 08:20:29PM -0500, Chenyuan Yang wrote: > > > The function sun4i_backend_atomic_check was dereferencing pointers > > > returned by drm_atomic_get_plane_state without checking for errors. This > > > could lead to undefined behavior if the function returns an error pointer. > > > > > > This commit adds checks using IS_ERR to ensure that plane_state is > > > valid before dereferencing them. > > > > > > Similar to commit da29abe71e16 > > > ("drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed"). > > > > > > Fixes: 96180dde23b7 ("drm/sun4i: backend: Add a custom atomic_check for the frontend") > > > Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com> > > > --- > > > drivers/gpu/drm/sun4i/sun4i_backend.c | 4 ++++ > > > 1 file changed, 4 insertions(+) > > > > > > diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c > > > index 2dded3b828df..a8e0e2123764 100644 > > > --- a/drivers/gpu/drm/sun4i/sun4i_backend.c > > > +++ b/drivers/gpu/drm/sun4i/sun4i_backend.c > > > @@ -490,6 +490,10 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine, > > > drm_for_each_plane_mask(plane, drm, crtc_state->plane_mask) { > > > struct drm_plane_state *plane_state = > > > drm_atomic_get_plane_state(state, plane); > > > + > > > + if (IS_ERR(plane_state)) > > > + return PTR_ERR(plane_state); > > > + > > > > This introduces a build warning. You shouldn't mix declarations and code. > > > > Maxime ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-08-07 10:37 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-03-14 1:20 [PATCH] drm/sun4i: backend: Fix error pointers in sun4i_backend_atomic_check Chenyuan Yang 2025-03-14 7:17 ` Maxime Ripard 2025-03-14 16:00 ` Chenyuan Yang 2025-08-07 10:34 ` Dan Carpenter
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).