Applied. Thanks! Alex On Thu, Dec 2, 2021 at 11:17 AM Zhou Qingyang <zhou1615@xxxxxxx> wrote: > > In amdgpu_connector_lcd_native_mode(), the return value of > drm_mode_duplicate() is assigned to mode, and there is a dereference > of it in amdgpu_connector_lcd_native_mode(), which will lead to a NULL > pointer dereference on failure of drm_mode_duplicate(). > > Fix this bug add a check of mode. > > This bug was found by a static analyzer. The analysis employs > differential checking to identify inconsistent security operations > (e.g., checks or kfrees) between two code paths and confirms that the > inconsistent operations are not recovered in the current function or > the callers, so they constitute bugs. > > Note that, as a bug found by static analysis, it can be a false > positive or hard to trigger. Multiple researchers have cross-reviewed > the bug. > > Builds with CONFIG_DRM_AMDGPU=m show no new warnings, and > our static analyzer no longer warns about this code. > > Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") > Signed-off-by: Zhou Qingyang <zhou1615@xxxxxxx> > --- > Changes in v2: > - Fix the similar bug in else clause > > drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c > index 0de66f59adb8..df1f9b88a53f 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c > @@ -387,6 +387,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder) > native_mode->vdisplay != 0 && > native_mode->clock != 0) { > mode = drm_mode_duplicate(dev, native_mode); > + if (!mode) > + return NULL; > + > mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; > drm_mode_set_name(mode); > > @@ -401,6 +404,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder) > * simpler. > */ > mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false); > + if (!mode) > + return NULL; > + > mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; > DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name); > } > -- > 2.25.1 >