2022-05-30 08:14:39

by baihaowen

Subject: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

The ctx->hw is dereferencing before null checking, so move
it after checking.

Signed-off-by: Haowen Bai <[email protected]>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
index bcccce292937..e59680cdd0ce 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
@@ -155,11 +155,13 @@ static void dpu_hw_wb_roi(struct dpu_hw_wb *ctx, struct dpu_hw_wb_cfg *wb)
static void dpu_hw_wb_setup_qos_lut(struct dpu_hw_wb *ctx,
struct dpu_hw_wb_qos_cfg *cfg)
{
- struct dpu_hw_blk_reg_map *c = &ctx->hw;
+ struct dpu_hw_blk_reg_map *c;
u32 qos_ctrl = 0;

if (!ctx || !cfg)
return;
+
+ c = &ctx->hw;

DPU_REG_WRITE(c, WB_DANGER_LUT, cfg->danger_lut);
DPU_REG_WRITE(c, WB_SAFE_LUT, cfg->safe_lut);
--
2.7.4

2022-06-01 09:43:18

by Dmitry Baryshkov

Subject: Re: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

A nit: patchwork thinks that two patches from the same author with the
same subject are two versions of the same patch. In future, could you
please send such patches with distinct names? No need to send v2 now
unless review shows other issues with the patches.

On Mon, 30 May 2022 at 10:33, Haowen Bai <[email protected]> wrote:
>
> The ctx->hw is dereferencing before null checking, so move
> it after checking.
>
> Signed-off-by: Haowen Bai <[email protected]>
> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)

Reviewed-by: Dmitry Baryshkov <[email protected]>

--
With best wishes
Dmitry

2022-06-01 11:54:02

by Rob Clark

Subject: Re: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

On Mon, May 30, 2022 at 12:34 AM Haowen Bai <[email protected]> wrote:
>
> The ctx->hw is dereferencing before null checking, so move
> it after checking.
>
> Signed-off-by: Haowen Bai <[email protected]>
> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> index bcccce292937..e59680cdd0ce 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> @@ -155,11 +155,13 @@ static void dpu_hw_wb_roi(struct dpu_hw_wb *ctx, struct dpu_hw_wb_cfg *wb)
> static void dpu_hw_wb_setup_qos_lut(struct dpu_hw_wb *ctx,
> struct dpu_hw_wb_qos_cfg *cfg)
> {
> - struct dpu_hw_blk_reg_map *c = &ctx->hw;
> + struct dpu_hw_blk_reg_map *c;
> u32 qos_ctrl = 0;
>
> if (!ctx || !cfg)
> return;
> +
> + c = &ctx->hw;

tbh, we should just drop both of these null checks.. there is no
codepath that can reach this with potential for either param to be
NULL

BR,
-R

>
> DPU_REG_WRITE(c, WB_DANGER_LUT, cfg->danger_lut);
> DPU_REG_WRITE(c, WB_SAFE_LUT, cfg->safe_lut);
> --
> 2.7.4
>

2022-06-01 19:46:14

by baihaowen

Subject: Re: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

在 2022/5/30 下午3:33, Haowen Bai 写道:
> The ctx->hw is dereferencing before null checking, so move
> it after checking.
>
> Signed-off-by: Haowen Bai <[email protected]>
> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> index bcccce292937..e59680cdd0ce 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> @@ -155,11 +155,13 @@ static void dpu_hw_wb_roi(struct dpu_hw_wb *ctx, struct dpu_hw_wb_cfg *wb)
> static void dpu_hw_wb_setup_qos_lut(struct dpu_hw_wb *ctx,
> struct dpu_hw_wb_qos_cfg *cfg)
> {
> - struct dpu_hw_blk_reg_map *c = &ctx->hw;
> + struct dpu_hw_blk_reg_map *c;
> u32 qos_ctrl = 0;
>
> if (!ctx || !cfg)
> return;
> +
> + c = &ctx->hw;
>
> DPU_REG_WRITE(c, WB_DANGER_LUT, cfg->danger_lut);
> DPU_REG_WRITE(c, WB_SAFE_LUT, cfg->safe_lut);
Sorry, plz ignore this patch.

ctx->hw is dereferenced, &ctx->hw is just a pointer math for pointer address offset, so it would not cause a bug(dereferencing null pointer).



--
Haowen Bai

2022-06-01 20:13:43

by Abhinav Kumar

Subject: Re: [PATCH] drm/msm/dpu: Fix pointer dereferenced before checking

On 5/30/2022 12:33 AM, Haowen Bai wrote:
> The ctx->hw is dereferencing before null checking, so move
> it after checking.
>
> Signed-off-by: Haowen Bai <[email protected]>

Agree with Dmitry's comment. Adjust the patch subject to a different one
otherwise PW thinks they are same patches.

Reviewed-by: Abhinav Kumar <[email protected]>

> ---
> drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> index bcccce292937..e59680cdd0ce 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
> @@ -155,11 +155,13 @@ static void dpu_hw_wb_roi(struct dpu_hw_wb *ctx, struct dpu_hw_wb_cfg *wb)
> static void dpu_hw_wb_setup_qos_lut(struct dpu_hw_wb *ctx,
> struct dpu_hw_wb_qos_cfg *cfg)
> {
> - struct dpu_hw_blk_reg_map *c = &ctx->hw;
> + struct dpu_hw_blk_reg_map *c;
> u32 qos_ctrl = 0;
>
> if (!ctx || !cfg)
> return;
> +
> + c = &ctx->hw;
>
> DPU_REG_WRITE(c, WB_DANGER_LUT, cfg->danger_lut);
> DPU_REG_WRITE(c, WB_SAFE_LUT, cfg->safe_lut);