Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32;
Message-ID: <2346aa93e2479f2ebd8849c5b2ead36a50ce43a0.camel@redhat.com>
Subject: Re: [PATCH] drm/i2c/ch7006: fix a possible null pointer dereference
From:   Lyude Paul <lyude@redhat.com>
To:     Ma Ke <make_ruc2021@163.com>, airlied@gmail.com, daniel@ffwll.ch,
        javierm@redhat.com, mripard@kernel.org,
        u.kleine-koenig@pengutronix.de, noralf@tronnes.org,
        tzimmermann@suse.de
Cc:     dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Date:   Mon, 09 Oct 2023 17:45:48 -0400
In-Reply-To: <20231007031712.3997144-1-make_ruc2021@163.com>
References: <20231007031712.3997144-1-make_ruc2021@163.com>
Organization: Red Hat Inc.
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
MIME-Version: 1.0
Precedence: bulk

On Sat, 2023-10-07 at 11:17 +0800, Ma Ke wrote:
> In ch7006_encoder_get_modes(), the return value of drm_mode_duplicate()
> is assigned to mode, which will lead to a NULL pointer dereference
> on failure of drm_mode_duplicate(). Add a check to avoid npd.
>=20
> Signed-off-by: Ma Ke <make_ruc2021@163.com>
> ---
>  drivers/gpu/drm/i2c/ch7006_drv.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>=20
> diff --git a/drivers/gpu/drm/i2c/ch7006_drv.c b/drivers/gpu/drm/i2c/ch700=
6_drv.c
> index 131512a5f3bd..27c2f02f5b43 100644
> --- a/drivers/gpu/drm/i2c/ch7006_drv.c
> +++ b/drivers/gpu/drm/i2c/ch7006_drv.c
> @@ -236,8 +236,10 @@ static int ch7006_encoder_get_modes(struct drm_encod=
er *encoder,
>  		    ~mode->valid_norms & 1<<priv->norm)
>  			continue;
> =20
> -		drm_mode_probed_add(connector,
> -				drm_mode_duplicate(encoder->dev, &mode->mode));
> +		struct drm_display_mode *encoder_mode;
> +		encoder_mode =3D drm_mode_duplicate(encoder->dev, &mode->mode);

I think the kernel prefers to have variable declaration at the top of the
scope, and as well: this breaks things because you don't add back the
drm_mode_probed_add() call.

> +		if (!mode)
> +			continue;
> =20
>  		n++;
>  	}

--=20
Cheers,
 Lyude Paul (she/her)
 Software Engineer at Red Hat