This is a note to let you know that I've just added the patch titled
stm: ltdc: fix two incorrect NULL checks on list iterator
to the 5.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
stm-ltdc-fix-two-incorrect-null-checks-on-list-iterator.patch
and it can be found in the queue-5.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 2e6c86be0e57079d1fb6c7c7e5423db096d0548a Mon Sep 17 00:00:00 2001
From: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
Date: Sun, 27 Mar 2022 13:53:55 +0800
Subject: stm: ltdc: fix two incorrect NULL checks on list iterator
From: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
commit 2e6c86be0e57079d1fb6c7c7e5423db096d0548a upstream.
The two bugs are here:
if (encoder) {
if (bridge && bridge->timings)
The list iterator value 'encoder/bridge' will *always* be set and
non-NULL by drm_for_each_encoder()/list_for_each_entry(), so it is
incorrect to assume that the iterator value will be NULL if the
list is empty or no element is found.
To fix the bug, use a new variable '*_iter' as the list iterator,
while use the old variable 'encoder/bridge' as a dedicated pointer
to point to the found element.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 99e360442f223 ("drm/stm: Fix bus_flags handling")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@xxxxxxxxx>
Acked-by: Raphael Gallais-Pou <raphael.gallais-pou@xxxxxxxxxxx>
Signed-off-by: Philippe Cornu <philippe.cornu@xxxxxxxxxxx>
Link: https://patchwork.freedesktop.org/patch/msgid/20220327055355.3808-1-xiam0nd.tong@xxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/stm/ltdc.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/stm/ltdc.c
+++ b/drivers/gpu/drm/stm/ltdc.c
@@ -869,8 +869,8 @@ static void ltdc_crtc_mode_set_nofb(stru
struct drm_device *ddev = crtc->dev;
struct drm_connector_list_iter iter;
struct drm_connector *connector = NULL;
- struct drm_encoder *encoder = NULL;
- struct drm_bridge *bridge = NULL;
+ struct drm_encoder *encoder = NULL, *en_iter;
+ struct drm_bridge *bridge = NULL, *br_iter;
struct drm_display_mode *mode = &crtc->state->adjusted_mode;
u32 hsync, vsync, accum_hbp, accum_vbp, accum_act_w, accum_act_h;
u32 total_width, total_height;
@@ -880,15 +880,19 @@ static void ltdc_crtc_mode_set_nofb(stru
int ret;
/* get encoder from crtc */
- drm_for_each_encoder(encoder, ddev)
- if (encoder->crtc == crtc)
+ drm_for_each_encoder(en_iter, ddev)
+ if (en_iter->crtc == crtc) {
+ encoder = en_iter;
break;
+ }
if (encoder) {
/* get bridge from encoder */
- list_for_each_entry(bridge, &encoder->bridge_chain, chain_node)
- if (bridge->encoder == encoder)
+ list_for_each_entry(br_iter, &encoder->bridge_chain, chain_node)
+ if (br_iter->encoder == encoder) {
+ bridge = br_iter;
break;
+ }
/* Get the connector from encoder */
drm_connector_list_iter_begin(ddev, &iter);
Patches currently in stable-queue which might be from xiam0nd.tong@xxxxxxxxx are
queue-5.18/md-fix-an-incorrect-null-check-in-does_sb_need_changing.patch
queue-5.18/stm-ltdc-fix-two-incorrect-null-checks-on-list-iterator.patch
queue-5.18/scsi-dc395x-fix-a-missing-check-on-list-iterator.patch
queue-5.18/iommu-msm-fix-an-incorrect-null-check-on-list-iterator.patch
queue-5.18/carl9170-tx-fix-an-incorrect-use-of-list-iterator.patch
queue-5.18/tilcdc-tilcdc_external-fix-an-incorrect-null-check-on-list-iterator.patch
queue-5.18/drm-nouveau-clk-fix-an-incorrect-null-check-on-list-iterator.patch
queue-5.18/media-uvcvideo-fix-missing-check-to-determine-if-ele.patch
queue-5.18/md-fix-an-incorrect-null-check-in-md_reload_sb.patch
queue-5.18/drm-nouveau-kms-nv50-atom-fix-an-incorrect-null-check-on-list-iterator.patch
