* [PATCH] fbdev: Check fb_add_videomode to prevent null-ptr-deref
@ 2025-07-24 3:25 Chenyuan Yang
2025-07-27 18:04 ` Helge Deller
0 siblings, 1 reply; 2+ messages in thread
From: Chenyuan Yang @ 2025-07-24 3:25 UTC (permalink / raw)
To: s.hauer, deller
Cc: kernel, shawnguo, festevam, msp, plagnioj, linux-fbdev,
linux-arm-kernel, dri-devel, imx, linux-kernel, Chenyuan Yang
fb_add_videomode() can fail with -ENOMEM when its internal kmalloc()
cannot allocate a struct fb_modelist.
If that happens, the modelist stays empty but the driver continues to
register.
Add a check for its return value to prevent poteintial null-ptr-deref,
which is similar to the commit 17186f1f90d3
("fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var").
Fixes: 1b6c79361ba5 ("video: imxfb: Add DT support")
Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
---
drivers/video/fbdev/imxfb.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index f30da32cdaed..a077bf346bdf 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -996,8 +996,13 @@ static int imxfb_probe(struct platform_device *pdev)
info->fix.smem_start = fbi->map_dma;
INIT_LIST_HEAD(&info->modelist);
- for (i = 0; i < fbi->num_modes; i++)
- fb_add_videomode(&fbi->mode[i].mode, &info->modelist);
+ for (i = 0; i < fbi->num_modes; i++) {
+ ret = fb_add_videomode(&fbi->mode[i].mode, &info->modelist);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to add videomode\n");
+ goto failed_cmap;
+ }
+ }
/*
* This makes sure that our colour bitfield
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] fbdev: Check fb_add_videomode to prevent null-ptr-deref
2025-07-24 3:25 [PATCH] fbdev: Check fb_add_videomode to prevent null-ptr-deref Chenyuan Yang
@ 2025-07-27 18:04 ` Helge Deller
0 siblings, 0 replies; 2+ messages in thread
From: Helge Deller @ 2025-07-27 18:04 UTC (permalink / raw)
To: Chenyuan Yang; +Cc: linux-fbdev, dri-devel, imx
On 7/24/25 05:25, Chenyuan Yang wrote:
> fb_add_videomode() can fail with -ENOMEM when its internal kmalloc()
> cannot allocate a struct fb_modelist.
> If that happens, the modelist stays empty but the driver continues to
> register.
> Add a check for its return value to prevent poteintial null-ptr-deref,
> which is similar to the commit 17186f1f90d3
> ("fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var").
>
> Fixes: 1b6c79361ba5 ("video: imxfb: Add DT support")
> Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
> ---
> drivers/video/fbdev/imxfb.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
applied.
Thanks!
Helge
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-07-27 16:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-24 3:25 [PATCH] fbdev: Check fb_add_videomode to prevent null-ptr-deref Chenyuan Yang
2025-07-27 18:04 ` Helge Deller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).