Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9cc9683a authored by Ziqi Zhao's avatar Ziqi Zhao Committed by Greg Kroah-Hartman
Browse files

drm/crtc: Fix uninit-value bug in drm_mode_setcrtc 



[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ]

The connector_set contains uninitialized values when allocated with
kmalloc_array. However, in the "out" branch, the logic assumes that any
element in connector_set would be equal to NULL if failed to
initialize, which causes the bug reported by Syzbot. The fix is to use
an extra variable to keep track of how many connectors are initialized
indeed, and use that variable to decrease any refcounts in the "out"
branch.

Reported-by: default avatar <syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com>
Signed-off-by: default avatarZiqi Zhao <astrajoan@yahoo.com>
Reported-and-tested-by: default avatar <syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com>
Tested-by: default avatarHarshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com


Signed-off-by: default avatarMaxime Ripard <mripard@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 2f601e86

drivers/gpu/drm/drm_crtc.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -535,8 +535,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, 
	struct drm_mode_set set;

	struct drm_mode_set set;

	uint32_t __user *set_connectors_ptr;

	uint32_t __user *set_connectors_ptr;

	struct drm_modeset_acquire_ctx ctx;

	struct drm_modeset_acquire_ctx ctx;

	int ret;

	int ret, i, num_connectors;

	int i;





	if (!drm_core_check_feature(dev, DRIVER_MODESET))

	if (!drm_core_check_feature(dev, DRIVER_MODESET))

		return -EOPNOTSUPP;

		return -EOPNOTSUPP;
@@ -674,6 +673,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, 
			goto out;

			goto out;

		}

		}





		num_connectors = 0;

		for (i = 0; i < crtc_req->count_connectors; i++) {

		for (i = 0; i < crtc_req->count_connectors; i++) {

			connector_set[i] = NULL;

			connector_set[i] = NULL;

			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;

			set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
@@ -694,6 +694,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, 
					connector->name);

					connector->name);





			connector_set[i] = connector;

			connector_set[i] = connector;

			num_connectors++;

		}

		}

	}

	}
@@ -702,7 +703,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, 
	set.y = crtc_req->y;

	set.y = crtc_req->y;

	set.mode = mode;

	set.mode = mode;

	set.connectors = connector_set;

	set.connectors = connector_set;

	set.num_connectors = crtc_req->count_connectors;

	set.num_connectors = num_connectors;

	set.fb = fb;

	set.fb = fb;





	if (drm_drv_uses_atomic_modeset(dev))

	if (drm_drv_uses_atomic_modeset(dev))
@@ -715,7 +716,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, 
		drm_framebuffer_put(fb);

		drm_framebuffer_put(fb);





	if (connector_set) {

	if (connector_set) {

		for (i = 0; i < crtc_req->count_connectors; i++) {

		for (i = 0; i < num_connectors; i++) {

			if (connector_set[i])

			if (connector_set[i])

				drm_connector_put(connector_set[i]);

				drm_connector_put(connector_set[i]);

		}

		}