1. 13 Dec, 2021 16 commits
  2. 07 Dec, 2021 23 commits
  3. 02 Dec, 2021 1 commit
    • Zhou Qingyang's avatar
      drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() · ab50cb9d
      Zhou Qingyang authored
      In radeon_driver_open_kms(), radeon_vm_bo_add() is assigned to
      vm->ib_bo_va and passes and used in radeon_vm_bo_set_addr(). In
      radeon_vm_bo_set_addr(), there is a dereference of vm->ib_bo_va,
      which could lead to a NULL pointer dereference on failure of
      radeon_vm_bo_add().
      
      Fix this bug by adding a check of vm->ib_bo_va.
      
      This bug was found by a static analyzer. The analysis employs
      differential checking to identify inconsistent security operations
      (e.g., checks or kfrees) between two code paths and confirms that the
      inconsistent operations are not recovered in the current function or
      the callers, so they constitute bugs.
      
      Note that, as a bug found by static analysis, it can be a false
      positive or hard to trigger. Multiple researchers have cross-reviewed
      the bug.
      
      Builds with CONFIG_DRM_RADEON=m show no new warnings,
      and our static analyzer no longer warns about this code.
      
      Fixes: cc9e67e3 ("drm/radeon: fix VM IB handling")
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarZhou Qingyang <zhou1615@umn.edu>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      ab50cb9d