[PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes

[PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes

[Charles Han]

From: hanchunchao <hanchunchao@inspur.com>

In hx83102_get_modes(), the return value of drm_mode_duplicate() is
assigned to mode, which will lead to a possible NULL pointer dereference
on failure of drm_mode_duplicate(). Add a check to avoid npd.

Signed-off-by: hanchunchao <hanchunchao@inspur.com>
---
 drivers/gpu/drm/panel/panel-himax-hx83102.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/panel/panel-himax-hx83102.c b/drivers/gpu/drm/panel/panel-himax-hx83102.c
index 6e4b7e4644ce..048c2c5897ae 100644
--- a/drivers/gpu/drm/panel/panel-himax-hx83102.c
+++ b/drivers/gpu/drm/panel/panel-himax-hx83102.c
@@ -565,6 +565,10 @@ static int hx83102_get_modes(struct drm_panel *panel,
 	struct drm_display_mode *mode;
 
 	mode = drm_mode_duplicate(connector->dev, m);
+	if (!mode) {
+		dev_err(connector->dev, "bad mode or failed to add mode\n");
+		return -EINVAL;
+	}
 
 	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
 	drm_mode_set_name(mode);
-- 
2.39.3

Re: [PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes

[Greg KH]

On Wed, Aug 21, 2024 at 05:50:39PM +0800, Charles Han wrote:
> From: hanchunchao <hanchunchao@inspur.com>

Nit, this should be your name, not your email alias here, like you have
it on your "From" line.

> In hx83102_get_modes(), the return value of drm_mode_duplicate() is
> assigned to mode, which will lead to a possible NULL pointer dereference
> on failure of drm_mode_duplicate(). Add a check to avoid npd.
> 
> Signed-off-by: hanchunchao <hanchunchao@inspur.com>

Same here.

What commit id does this fix?  Shouldn't you also cc: stable to get it
backported?

And there's no need to cc: security@kernel.org, as this is a public
issue and you have a patch for it.

thanks,

greg k-h

Re: [PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes

[kernel test robot]

Hi Charles,

kernel test robot noticed the following build errors:

[auto build test ERROR on linus/master]
[also build test ERROR on v6.11-rc4 next-20240821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Charles-Han/drm-panel-hx83102-fix-null-pointer-dereference-in-hx83102_get_modes/20240821-191703
base:   linus/master
patch link:    https://lore.kernel.org/r/20240821095039.15282-1-hanchunchao%40inspur.com
patch subject: [PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes
config: s390-allyesconfig (https://download.01.org/0day-ci/archive/20240822/202408221044.vVHNGMnS-lkp@intel.com/config)
compiler: s390-linux-gcc (GCC) 14.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240822/202408221044.vVHNGMnS-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202408221044.vVHNGMnS-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from include/linux/device.h:15,
                    from include/linux/blk_types.h:11,
                    from include/linux/writeback.h:13,
                    from include/linux/memcontrol.h:23,
                    from include/linux/swap.h:9,
                    from include/linux/suspend.h:5,
                    from include/linux/regulator/consumer.h:35,
                    from drivers/gpu/drm/panel/panel-himax-hx83102.c:14:
   drivers/gpu/drm/panel/panel-himax-hx83102.c: In function 'hx83102_get_modes':
>> drivers/gpu/drm/panel/panel-himax-hx83102.c:569:34: error: passing argument 1 of '_dev_err' from incompatible pointer type [-Wincompatible-pointer-types]
     569 |                 dev_err(connector->dev, "bad mode or failed to add mode\n");
         |                         ~~~~~~~~~^~~~~
         |                                  |
         |                                  struct drm_device *
   include/linux/dev_printk.h:110:25: note: in definition of macro 'dev_printk_index_wrap'
     110 |                 _p_func(dev, fmt, ##__VA_ARGS__);                       \
         |                         ^~~
   drivers/gpu/drm/panel/panel-himax-hx83102.c:569:17: note: in expansion of macro 'dev_err'
     569 |                 dev_err(connector->dev, "bad mode or failed to add mode\n");
         |                 ^~~~~~~
   include/linux/dev_printk.h:50:36: note: expected 'const struct device *' but argument is of type 'struct drm_device *'
      50 | void _dev_err(const struct device *dev, const char *fmt, ...);
         |               ~~~~~~~~~~~~~~~~~~~~~^~~


vim +/_dev_err +569 drivers/gpu/drm/panel/panel-himax-hx83102.c

   559	
   560	static int hx83102_get_modes(struct drm_panel *panel,
   561				    struct drm_connector *connector)
   562	{
   563		struct hx83102 *ctx = panel_to_hx83102(panel);
   564		const struct drm_display_mode *m = ctx->desc->modes;
   565		struct drm_display_mode *mode;
   566	
   567		mode = drm_mode_duplicate(connector->dev, m);
   568		if (!mode) {
 > 569			dev_err(connector->dev, "bad mode or failed to add mode\n");
   570			return -EINVAL;
   571		}
   572	
   573		mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
   574		drm_mode_set_name(mode);
   575		drm_mode_probed_add(connector, mode);
   576	
   577		connector->display_info.width_mm = ctx->desc->size.width_mm;
   578		connector->display_info.height_mm = ctx->desc->size.height_mm;
   579		connector->display_info.bpc = 8;
   580	
   581		return 1;
   582	}
   583	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes

[kernel test robot]

Hi Charles,

kernel test robot noticed the following build errors:

[auto build test ERROR on linus/master]
[also build test ERROR on v6.11-rc4 next-20240821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Charles-Han/drm-panel-hx83102-fix-null-pointer-dereference-in-hx83102_get_modes/20240821-191703
base:   linus/master
patch link:    https://lore.kernel.org/r/20240821095039.15282-1-hanchunchao%40inspur.com
patch subject: [PATCH] drm/panel/hx83102: fix null pointer dereference in hx83102_get_modes
config: s390-allmodconfig (https://download.01.org/0day-ci/archive/20240822/202408221127.2O9Pauzi-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 26670e7fa4f032a019d23d56c6a02926e854e8af)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240822/202408221127.2O9Pauzi-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202408221127.2O9Pauzi-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from drivers/gpu/drm/panel/panel-himax-hx83102.c:12:
   In file included from include/linux/module.h:19:
   In file included from include/linux/elf.h:6:
   In file included from arch/s390/include/asm/elf.h:181:
   In file included from arch/s390/include/asm/mmu_context.h:11:
   In file included from arch/s390/include/asm/pgalloc.h:18:
   In file included from include/linux/mm.h:2228:
   include/linux/vmstat.h:503:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
     503 |         return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~ ^
     504 |                            item];
         |                            ~~~~
   include/linux/vmstat.h:510:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
     510 |         return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~ ^
     511 |                            NR_VM_NUMA_EVENT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~~
   include/linux/vmstat.h:517:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
     517 |         return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
         |                               ~~~~~~~~~~~ ^ ~~~
   include/linux/vmstat.h:523:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
     523 |         return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~ ^
     524 |                            NR_VM_NUMA_EVENT_ITEMS +
         |                            ~~~~~~~~~~~~~~~~~~~~~~
>> drivers/gpu/drm/panel/panel-himax-hx83102.c:569:11: error: incompatible pointer types passing 'struct drm_device *' to parameter of type 'const struct device *' [-Werror,-Wincompatible-pointer-types]
     569 |                 dev_err(connector->dev, "bad mode or failed to add mode\n");
         |                         ^~~~~~~~~~~~~~
   include/linux/dev_printk.h:154:44: note: expanded from macro 'dev_err'
     154 |         dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
         |                                                   ^~~
   include/linux/dev_printk.h:110:11: note: expanded from macro 'dev_printk_index_wrap'
     110 |                 _p_func(dev, fmt, ##__VA_ARGS__);                       \
         |                         ^~~
   include/linux/dev_printk.h:50:36: note: passing argument to parameter 'dev' here
      50 | void _dev_err(const struct device *dev, const char *fmt, ...);
         |                                    ^
   4 warnings and 1 error generated.


vim +569 drivers/gpu/drm/panel/panel-himax-hx83102.c

   559	
   560	static int hx83102_get_modes(struct drm_panel *panel,
   561				    struct drm_connector *connector)
   562	{
   563		struct hx83102 *ctx = panel_to_hx83102(panel);
   564		const struct drm_display_mode *m = ctx->desc->modes;
   565		struct drm_display_mode *mode;
   566	
   567		mode = drm_mode_duplicate(connector->dev, m);
   568		if (!mode) {
 > 569			dev_err(connector->dev, "bad mode or failed to add mode\n");
   570			return -EINVAL;
   571		}
   572	
   573		mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
   574		drm_mode_set_name(mode);
   575		drm_mode_probed_add(connector, mode);
   576	
   577		connector->display_info.width_mm = ctx->desc->size.width_mm;
   578		connector->display_info.height_mm = ctx->desc->size.height_mm;
   579		connector->display_info.bpc = 8;
   580	
   581		return 1;
   582	}
   583	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki