On Wed, Dec 1, 2021 at 4:29 PM Zhou Qingyang <zhou1615@xxxxxxx> wrote: > > In cdv_intel_dp_get_modes(), the third return value of > drm_mode_duplicate() is assigned to mode and used in > drm_mode_probed_add(). drm_mode_probed_add() passes mode->head to > list_add_tail(). list_add_tail() will further call __list_add() and > there is a dereference of mode->head in __list_add(), which could lead > to a wild pointer dereference on failure of drm_mode_duplicate(). > > Fix this bug by adding a check of mode. > > This bug was found by a static analyzer. The analysis employs > differential checking to identify inconsistent security operations > (e.g., checks or kfrees) between two code paths and confirms that the > inconsistent operations are not recovered in the current function or > the callers, so they constitute bugs. > > Note that, as a bug found by static analysis, it can be a false > positive or hard to trigger. Multiple researchers have cross-reviewed > the bug. > Is it really necessary to explain what the static analyzer does and that it can be faulty in every single patch? "This bug was found by a static analyzer" is enough for me. > Builds with CONFIG_DRM_GMA500=m show no new warnings, > and our static analyzer no longer warns about this code. I assume all patches to be at least compile tested before submitted, so if you didn't actually run this code on hardware it's better to replace the above with: "Only compile tested". -Patrik > > Fixes: d112a8163f83 ("gma500/cdv: Add eDP support") > Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx> > --- > Changes in V2: > - Instead of returning -ENOMEM, this patch returns 0 > - Use DRM_DEBUG_KMS to report the failure of drm_mode_duplicate() > > drivers/gpu/drm/gma500/cdv_intel_dp.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c > index ba6ad1466374..bf47db488b7b 100644 > --- a/drivers/gpu/drm/gma500/cdv_intel_dp.c > +++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c > @@ -1773,6 +1773,11 @@ static int cdv_intel_dp_get_modes(struct drm_connector *connector) > if (intel_dp->panel_fixed_mode != NULL) { > struct drm_display_mode *mode; > mode = drm_mode_duplicate(dev, intel_dp->panel_fixed_mode); > + if (!mode) { > + DRM_DEBUG_KMS("Failure in drm_mode_duplicate()\n"); > + return 0; > + } > + > drm_mode_probed_add(connector, mode); > return 1; > } > -- > 2.25.1 >