[PATCH] drm/meson: fix NULL pointer dereference in meson_drv_bind_master()

[PATCH] drm/meson: fix NULL pointer dereference in meson_drv_bind_master()

[Rand Deeb]

If the allocation of priv fails, meson_drv_bind_master() jumps to the
free_drm label, which calls meson_encoder_{dsi,hdmi,cvbs}_remove() with
a NULL priv. These functions dereference priv, so the error path oopses
instead of returning -ENOMEM.

Only the drm device has been allocated at that point, so put it and
return directly.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
Compile tested only.

Fixes: 6a044642988b ("drm/meson: fix unbind path if HDMI fails to bind")
Signed-off-by: Rand Deeb <rand.sec96@gmail.com>
---
 drivers/gpu/drm/meson/meson_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 38bf2811d..a9b707062 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -204,8 +204,8 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
 
 	priv = devm_kzalloc_obj(dev, *priv);
 	if (!priv) {
-		ret = -ENOMEM;
-		goto free_drm;
+		drm_dev_put(drm);
+		return -ENOMEM;
 	}
 	drm->dev_private = priv;
 	priv->drm = drm;

base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
-- 
2.39.5


_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

Re: [PATCH] drm/meson: fix NULL pointer dereference in meson_drv_bind_master()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] drm/meson: missing drm_kms_helper_poll_fini() on error in
  meson_drv_bind_master() [1]
--

commit 79a6a19243f321e0c18a04ea82e4aefcdcacddf4
Author: Rand Deeb <rand.sec96@gmail.com>

drm/meson: fix NULL pointer dereference in meson_drv_bind_master()

This commit avoids jumping to free_drm when allocating priv fails in
meson_drv_bind_master(), directly putting the drm device and returning -ENOMEM
so encoder removal helpers are not called with a NULL priv.

> diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
> index 38bf2811d068d..a9b707062b4f6 100644
> --- a/drivers/gpu/drm/meson/meson_drv.c
> +++ b/drivers/gpu/drm/meson/meson_drv.c
> @@ -204,8 +204,8 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)
>  
>  	priv = devm_kzalloc_obj(dev, *priv);
>  	if (!priv) {
> -		ret = -ENOMEM;
> -		goto free_drm;
> +		drm_dev_put(drm);
> +		return -ENOMEM;
>  	}
>  	drm->dev_private = priv;
>  	priv->drm = drm;

[Severity: Critical]
This problem wasn't introduced by this patch, but can a failure in
drm_dev_register() cause a use-after-free on
drm->mode_config.output_poll_work [1]?

drivers/gpu/drm/meson/meson_drv.c:meson_drv_bind_master() {
    ...
	drm_kms_helper_poll_init(drm);

	platform_set_drvdata(pdev, priv);

	ret = drm_dev_register(drm, 0);
	if (ret)
		goto uninstall_irq;
    ...
uninstall_irq:
	free_irq(priv->vsync_irq, drm);
}

When drm_dev_register() fails, jumping to uninstall_irq reaches
drm_dev_put() without calling drm_kms_helper_poll_fini(), leaving
output_poll_work active after the drm_device is freed.

[1] https://sashiko.dev/#/bug/linux-e1c69353-dace-476d-bef2-4ab1c205215c

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111091657.598-1-rand.sec96@gmail.com?part=1

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic