[PATCH] drm: simpledrm: fix a potential NULL dereference

Dan Carpenter dan.carpenter at oracle.com
Sat May 15 09:53:15 UTC 2021


The drm_format_info() function returns NULL if the format is
unsupported, but the simplefb_get_validated_format() is expected to
return error pointers.  If we propagate teh NULL return then it will
lead to a NULL dereference in the callers.  Swap the NULL and trade it
in for an ERR_PTR(-EINVAL).

Fixes: 11e8f5fd223b ("drm: Add simpledrm driver")
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
---
 drivers/gpu/drm/tiny/simpledrm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tiny/simpledrm.c b/drivers/gpu/drm/tiny/simpledrm.c
index f72ca3a1c2d4..4f605c5fe856 100644
--- a/drivers/gpu/drm/tiny/simpledrm.c
+++ b/drivers/gpu/drm/tiny/simpledrm.c
@@ -72,6 +72,7 @@ simplefb_get_validated_format(struct drm_device *dev, const char *format_name)
 	static const struct simplefb_format formats[] = SIMPLEFB_FORMATS;
 	const struct simplefb_format *fmt = formats;
 	const struct simplefb_format *end = fmt + ARRAY_SIZE(formats);
+	const struct drm_format_info *info;
 
 	if (!format_name) {
 		drm_err(dev, "simplefb: missing framebuffer format\n");
@@ -79,8 +80,12 @@ simplefb_get_validated_format(struct drm_device *dev, const char *format_name)
 	}
 
 	while (fmt < end) {
-		if (!strcmp(format_name, fmt->name))
-			return drm_format_info(fmt->fourcc);
+		if (!strcmp(format_name, fmt->name)) {
+			info = drm_format_info(fmt->fourcc);
+			if (!info)
+				return ERR_PTR(-EINVAL);
+			return info;
+		}
 		++fmt;
 	}
 
-- 
2.30.2



More information about the dri-devel mailing list