2023-03-06 10:09:30

by Johan Hovold

[permalink] [raw]
Subject: [PATCH 03/10] drm/msm: fix NULL-deref on snapshot tear down

In case of early initialisation errors and on platforms that do not use
the DPU controller, the deinitilisation code can be called with the kms
pointer set to NULL.

Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot")
Cc: [email protected] # 5.14
Cc: Abhinav Kumar <[email protected]>
Signed-off-by: Johan Hovold <[email protected]>
---
drivers/gpu/drm/msm/msm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 9ded384acba4..17a59d73fe01 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -242,7 +242,8 @@ static int msm_drm_uninit(struct device *dev)
msm_fbdev_free(ddev);
#endif

- msm_disp_snapshot_destroy(ddev);
+ if (kms)
+ msm_disp_snapshot_destroy(ddev);

drm_mode_config_cleanup(ddev);

--
2.39.2



2023-03-21 15:06:35

by Dmitry Baryshkov

[permalink] [raw]
Subject: Re: [PATCH 03/10] drm/msm: fix NULL-deref on snapshot tear down

On 06/03/2023 12:07, Johan Hovold wrote:
> In case of early initialisation errors and on platforms that do not use
> the DPU controller, the deinitilisation code can be called with the kms
> pointer set to NULL.
>
> Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot")
> Cc: [email protected] # 5.14
> Cc: Abhinav Kumar <[email protected]>
> Signed-off-by: Johan Hovold <[email protected]>

Reviewed-by: Dmitry Baryshkov <[email protected]>

> ---
> drivers/gpu/drm/msm/msm_drv.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
> index 9ded384acba4..17a59d73fe01 100644
> --- a/drivers/gpu/drm/msm/msm_drv.c
> +++ b/drivers/gpu/drm/msm/msm_drv.c
> @@ -242,7 +242,8 @@ static int msm_drm_uninit(struct device *dev)
> msm_fbdev_free(ddev);
> #endif
>
> - msm_disp_snapshot_destroy(ddev);
> + if (kms)
> + msm_disp_snapshot_destroy(ddev);
>
> drm_mode_config_cleanup(ddev);
>

--
With best wishes
Dmitry