Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1519613 > unrolled thread

[PATCH] Gpu: drm: arm: - Fix possible dereference of NULL

Back to article view | Back to linux.kernel

Contents

  [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL Shailendra Verma <shailendra.v@samsung.com> - 2016-11-11 09:50 +0100
    Re: [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL Liviu Dudau <liviu.dudau@arm.com> - 2016-11-11 12:00 +0100
      Re: [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL Emil Velikov <emil.l.velikov@gmail.com> - 2016-11-11 15:00 +0100
        Re: [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL Liviu Dudau <liviu.dudau@arm.com> - 2016-11-11 15:40 +0100

#1519613 — [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL

From: "Shailendra Verma" <shailendra.v@samsung.com>

There is possible dereference of NULL pointer if kmalloc fails.
So return NULL if kmalloc fails.

Signed-off-by: Shailendra Verma <Shailendra.v@samsung.com>
---
 drivers/gpu/drm/arm/malidp_planes.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
index 82c193e..f769398 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
 		return NULL;
 
 	state = kmalloc(sizeof(*state), GFP_KERNEL);
+	if (!state)
+		return NULL;
+
 	if (state) {
 		m_state = to_malidp_plane_state(plane->state);
 		__drm_atomic_helper_plane_duplicate_state(plane, &state->base);
-- 
1.7.9.5

[toc] | [next] | [standalone]

#1519686

Hi Shailendra,

On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
> From: "Shailendra Verma" <shailendra.v@samsung.com>
> 
> There is possible dereference of NULL pointer if kmalloc fails.

You could add: ... when the function returns. From the patch itself it is
not clear where the problem is.

> So return NULL if kmalloc fails.
> 
> Signed-off-by: Shailendra Verma <Shailendra.v@samsung.com>

Acked-by: Liviu Dudau <Liviu.Dudau@arm.com>

Thanks for spotting this!
Liviu

> ---
>  drivers/gpu/drm/arm/malidp_planes.c |    3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> index 82c193e..f769398 100644
> --- a/drivers/gpu/drm/arm/malidp_planes.c
> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
>  		return NULL;
>  
>  	state = kmalloc(sizeof(*state), GFP_KERNEL);
> +	if (!state)
> +		return NULL;
> +
>  	if (state) {
>  		m_state = to_malidp_plane_state(plane->state);
>  		__drm_atomic_helper_plane_duplicate_state(plane, &state->base);
> -- 
> 1.7.9.5
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯

[toc] | [prev] | [next] | [standalone]

#1519808

On 11 November 2016 at 10:56, Liviu Dudau <liviu.dudau@arm.com> wrote:
> Hi Shailendra,
>
> On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
>> From: "Shailendra Verma" <shailendra.v@samsung.com>
>>
>> There is possible dereference of NULL pointer if kmalloc fails.
>
> You could add: ... when the function returns. From the patch itself it is
> not clear where the problem is.
>
As the function returns we have "return &state->base;" Since base is
at offset 0 there will be no deref and the compiler will return NULL.
Not sure if that's 100% legal, though.

>> ---
>>  drivers/gpu/drm/arm/malidp_planes.c |    3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
>> index 82c193e..f769398 100644
>> --- a/drivers/gpu/drm/arm/malidp_planes.c
>> +++ b/drivers/gpu/drm/arm/malidp_planes.c
>> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
>>               return NULL;
>>
>>       state = kmalloc(sizeof(*state), GFP_KERNEL);
>> +     if (!state)
>> +             return NULL;
>> +
>>       if (state) {
Might want to drop this line - as-is things read quite weird ?

Either way, not my driver - so don't read too much into the above ;-)
Emil

[toc] | [prev] | [next] | [standalone]

#1519835

On Fri, Nov 11, 2016 at 01:58:46PM +0000, Emil Velikov wrote:
> On 11 November 2016 at 10:56, Liviu Dudau <liviu.dudau@arm.com> wrote:
> > Hi Shailendra,
> >
> > On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
> >> From: "Shailendra Verma" <shailendra.v@samsung.com>
> >>
> >> There is possible dereference of NULL pointer if kmalloc fails.
> >
> > You could add: ... when the function returns. From the patch itself it is
> > not clear where the problem is.
> >
> As the function returns we have "return &state->base;" Since base is
> at offset 0 there will be no deref and the compiler will return NULL.
> Not sure if that's 100% legal, though.
> 
> >> ---
> >>  drivers/gpu/drm/arm/malidp_planes.c |    3 +++
> >>  1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> >> index 82c193e..f769398 100644
> >> --- a/drivers/gpu/drm/arm/malidp_planes.c
> >> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> >> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
> >>               return NULL;
> >>
> >>       state = kmalloc(sizeof(*state), GFP_KERNEL);
> >> +     if (!state)
> >> +             return NULL;
> >> +
> >>       if (state) {
> Might want to drop this line - as-is things read quite weird ?

I've already done that in the patched that I've queued in my tree, I just need to push
it to the public tree.

... now if that server would be online when I need it .... :(

Best regards,
Liviu

> 
> Either way, not my driver - so don't read too much into the above ;-)
> Emil

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web