2022-05-30 11:07:08

by baihaowen

[permalink] [raw]
Subject: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

The phys_enc->wb_idx is dereferencing before null checking, so move
it after checking.

Signed-off-by: Haowen Bai <[email protected]>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
index 4829d1ce0cf8..59da348ff339 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
@@ -574,11 +574,11 @@ static void dpu_encoder_phys_wb_disable(struct dpu_encoder_phys *phys_enc)
*/
static void dpu_encoder_phys_wb_destroy(struct dpu_encoder_phys *phys_enc)
{
- DPU_DEBUG("[wb:%d]\n", phys_enc->wb_idx - WB_0);
-
if (!phys_enc)
return;

+ DPU_DEBUG("[wb:%d]\n", phys_enc->wb_idx - WB_0);
+
kfree(phys_enc);
}

--
2.7.4



2022-05-31 11:21:20

by Dmitry Baryshkov

[permalink] [raw]
Subject: Re: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

On Mon, 30 May 2022 at 05:20, Haowen Bai <[email protected]> wrote:
>
> The phys_enc->wb_idx is dereferencing before null checking, so move
> it after checking.
>
> Signed-off-by: Haowen Bai <[email protected]>
> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)

Reviewed-by: Dmitry Baryshkov <[email protected]>

--
With best wishes
Dmitry

2022-06-01 18:40:17

by baihaowen

[permalink] [raw]
Subject: Re: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

在 2022/5/31 上午8:36, Abhinav Kumar 写道:
>
>
> On 5/30/2022 12:33 AM, Haowen Bai wrote:
>> The ctx->hw is dereferencing before null checking, so move
>> it after checking.
>>
>> Signed-off-by: Haowen Bai <[email protected]>
>
> Agree with Dmitry's comment. Adjust the patch subject to a different one otherwise PW thinks they are same patches.
>
> Reviewed-by: Abhinav Kumar <[email protected]>
>
>> ---
>>   drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 4 +++-
>>   1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
>> index bcccce292937..e59680cdd0ce 100644
>> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
>> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
>> @@ -155,11 +155,13 @@ static void dpu_hw_wb_roi(struct dpu_hw_wb *ctx, struct dpu_hw_wb_cfg *wb)
>>   static void dpu_hw_wb_setup_qos_lut(struct dpu_hw_wb *ctx,
>>           struct dpu_hw_wb_qos_cfg *cfg)
>>   {
>> -    struct dpu_hw_blk_reg_map *c = &ctx->hw;
>> +    struct dpu_hw_blk_reg_map *c;
>>       u32 qos_ctrl = 0;
>>         if (!ctx || !cfg)
>>           return;
>> +   
>> +    c = &ctx->hw;
>>         DPU_REG_WRITE(c, WB_DANGER_LUT, cfg->danger_lut);
>>       DPU_REG_WRITE(c, WB_SAFE_LUT, cfg->safe_lut);
Sorry, plz ignore this patch.

ctx->hw is dereferenced, &ctx->hw is just a pointer math for pointer address offset, so it would not cause a bug(dereferencing null pointer).



--
Haowen Bai


2022-06-01 20:32:36

by Abhinav Kumar

[permalink] [raw]
Subject: Re: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking



On 5/29/2022 7:19 PM, Haowen Bai wrote:
> The phys_enc->wb_idx is dereferencing before null checking, so move
> it after checking.
>
> Signed-off-by: Haowen Bai <[email protected]>

Fixes: d7d0e73f7de33 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for
writeback")

Reviewed-by: Abhinav Kumar <[email protected]>

> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
> index 4829d1ce0cf8..59da348ff339 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
> @@ -574,11 +574,11 @@ static void dpu_encoder_phys_wb_disable(struct dpu_encoder_phys *phys_enc)
> */
> static void dpu_encoder_phys_wb_destroy(struct dpu_encoder_phys *phys_enc)
> {
> - DPU_DEBUG("[wb:%d]\n", phys_enc->wb_idx - WB_0);
> -
> if (!phys_enc)
> return;
>
> + DPU_DEBUG("[wb:%d]\n", phys_enc->wb_idx - WB_0);
> +
> kfree(phys_enc);
> }
>