• Shang XiaoJing's avatar
    drm: Fix potential null-ptr-deref due to drmm_mode_config_init() · 834c23e4
    Shang XiaoJing authored
    drmm_mode_config_init() will call drm_mode_create_standard_properties()
    and won't check the ret value. When drm_mode_create_standard_properties()
    failed due to alloc, property will be a NULL pointer and may causes the
    null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.
    
    Found null-ptr-deref while testing insert module bochs:
    general protection fault, probably for non-canonical address
        0xdffffc000000000c: 0000 [#1] SMP KASAN PTI
    KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
    CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
    rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
    RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]
    Call Trace:
     <TASK>
     __drm_connector_init+0xb6c/0x1100 [drm]
     bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]
     pci_device_probe+0x17d/0x340
     really_probe+0x1db/0x5d0
     __driver_probe_device+0x1e7/0x250
     driver_probe_device+0x4a/0x120
     __driver_attach+0xcd/0x2c0
     bus_for_each_dev+0x11a/0x1b0
     bus_add_driver+0x3d7/0x500
     driver_register+0x18e/0x320
     do_one_initcall+0xc4/0x3e0
     do_init_module+0x1b4/0x630
     load_module+0x5dca/0x7230
     __do_sys_finit_module+0x100/0x170
     do_syscall_64+0x3f/0x90
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    RIP: 0033:0x7ff65af9f839
    
    Fixes: 6b4959f4 ("drm/atomic: atomic plane properties")
    Signed-off-by: default avatarShang XiaoJing <shangxiaojing@huawei.com>
    Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
    Link: https://patchwork.freedesktop.org/patch/msgid/20221118021651.2460-1-shangxiaojing@huawei.com
    834c23e4
drm_mode_config.c 20.4 KB