From: "Shailendra Verma" <[email protected]>
There is possible dereference of NULL pointer if kmalloc fails.
So return NULL if kmalloc fails.
Signed-off-by: Shailendra Verma <[email protected]>
---
drivers/gpu/drm/arm/malidp_planes.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
index 82c193e..f769398 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
return NULL;
state = kmalloc(sizeof(*state), GFP_KERNEL);
+ if (!state)
+ return NULL;
+
if (state) {
m_state = to_malidp_plane_state(plane->state);
__drm_atomic_helper_plane_duplicate_state(plane, &state->base);
--
1.7.9.5
Hi Shailendra,
On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
> From: "Shailendra Verma" <[email protected]>
>
> There is possible dereference of NULL pointer if kmalloc fails.
You could add: ... when the function returns. From the patch itself it is
not clear where the problem is.
> So return NULL if kmalloc fails.
>
> Signed-off-by: Shailendra Verma <[email protected]>
Acked-by: Liviu Dudau <[email protected]>
Thanks for spotting this!
Liviu
> ---
> drivers/gpu/drm/arm/malidp_planes.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> index 82c193e..f769398 100644
> --- a/drivers/gpu/drm/arm/malidp_planes.c
> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
> return NULL;
>
> state = kmalloc(sizeof(*state), GFP_KERNEL);
> + if (!state)
> + return NULL;
> +
> if (state) {
> m_state = to_malidp_plane_state(plane->state);
> __drm_atomic_helper_plane_duplicate_state(plane, &state->base);
> --
> 1.7.9.5
>
--
====================
| I would like to |
| fix the world, |
| but they're not |
| giving me the |
\ source code! /
---------------
¯\_(ツ)_/¯
On 11 November 2016 at 10:56, Liviu Dudau <[email protected]> wrote:
> Hi Shailendra,
>
> On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
>> From: "Shailendra Verma" <[email protected]>
>>
>> There is possible dereference of NULL pointer if kmalloc fails.
>
> You could add: ... when the function returns. From the patch itself it is
> not clear where the problem is.
>
As the function returns we have "return &state->base;" Since base is
at offset 0 there will be no deref and the compiler will return NULL.
Not sure if that's 100% legal, though.
>> ---
>> drivers/gpu/drm/arm/malidp_planes.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
>> index 82c193e..f769398 100644
>> --- a/drivers/gpu/drm/arm/malidp_planes.c
>> +++ b/drivers/gpu/drm/arm/malidp_planes.c
>> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
>> return NULL;
>>
>> state = kmalloc(sizeof(*state), GFP_KERNEL);
>> + if (!state)
>> + return NULL;
>> +
>> if (state) {
Might want to drop this line - as-is things read quite weird ?
Either way, not my driver - so don't read too much into the above ;-)
Emil
On Fri, Nov 11, 2016 at 01:58:46PM +0000, Emil Velikov wrote:
> On 11 November 2016 at 10:56, Liviu Dudau <[email protected]> wrote:
> > Hi Shailendra,
> >
> > On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
> >> From: "Shailendra Verma" <[email protected]>
> >>
> >> There is possible dereference of NULL pointer if kmalloc fails.
> >
> > You could add: ... when the function returns. From the patch itself it is
> > not clear where the problem is.
> >
> As the function returns we have "return &state->base;" Since base is
> at offset 0 there will be no deref and the compiler will return NULL.
> Not sure if that's 100% legal, though.
>
> >> ---
> >> drivers/gpu/drm/arm/malidp_planes.c | 3 +++
> >> 1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> >> index 82c193e..f769398 100644
> >> --- a/drivers/gpu/drm/arm/malidp_planes.c
> >> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> >> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
> >> return NULL;
> >>
> >> state = kmalloc(sizeof(*state), GFP_KERNEL);
> >> + if (!state)
> >> + return NULL;
> >> +
> >> if (state) {
> Might want to drop this line - as-is things read quite weird ?
I've already done that in the patched that I've queued in my tree, I just need to push
it to the public tree.
... now if that server would be online when I need it .... :(
Best regards,
Liviu
>
> Either way, not my driver - so don't read too much into the above ;-)
> Emil
--
====================
| I would like to |
| fix the world, |
| but they're not |
| giving me the |
\ source code! /
---------------
¯\_(ツ)_/¯