[PATCH v1 2/2] drm/sprd: fix potential NULL dereference

[Thomas Zimmermann]

Hi,

on the changes for platform_get_resource(), you can

Acked-by: Thomas Zimmermann <tzimmermann at suse.de>

but see my comments below.

Am 24.12.21 um 15:12 schrieb Kevin Tang:
> platform_get_resource() may fail and return NULL, so check it's value
> before using it.
> 
> 'drm' could be null in sprd_drm_shutdown, and drm_warn maybe dereference
> it, remove this warning log.
> 
> Cc: Orson Zhai <orsonzhai at gmail.com>
> Cc: Chunyan Zhang <zhang.lyra at gmail.com>
> Signed-off-by: Kevin Tang <kevin.tang at unisoc.com>
> ---
>   drivers/gpu/drm/sprd/sprd_dpu.c | 3 +++
>   drivers/gpu/drm/sprd/sprd_drm.c | 8 ++------
>   drivers/gpu/drm/sprd/sprd_dsi.c | 3 +++
>   3 files changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/sprd/sprd_dpu.c b/drivers/gpu/drm/sprd/sprd_dpu.c
> index 06a3414ee..69683b7ba 100644
> --- a/drivers/gpu/drm/sprd/sprd_dpu.c
> +++ b/drivers/gpu/drm/sprd/sprd_dpu.c
> @@ -790,6 +790,9 @@ static int sprd_dpu_context_init(struct sprd_dpu *dpu,
>   	int ret;
>   
>   	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> +	if (!res)
> +		return -EINVAL;
> +

You can add an error message if this fails.


>   	ctx->base = devm_ioremap(dev, res->start, resource_size(res));
>   	if (!ctx->base) {
>   		dev_err(dev, "failed to map dpu registers\n");
> diff --git a/drivers/gpu/drm/sprd/sprd_drm.c b/drivers/gpu/drm/sprd/sprd_drm.c
> index a077e2d4d..54030839e 100644
> --- a/drivers/gpu/drm/sprd/sprd_drm.c
> +++ b/drivers/gpu/drm/sprd/sprd_drm.c
> @@ -154,12 +154,8 @@ static void sprd_drm_shutdown(struct platform_device *pdev)
>   {
>   	struct drm_device *drm = platform_get_drvdata(pdev);
>   
> -	if (!drm) {
> -		drm_warn(drm, "drm device is not available, no shutdown\n");
> -		return;
> -	}
> -
> -	drm_atomic_helper_shutdown(drm);
> +	if (drm)
> +		drm_atomic_helper_shutdown(drm);

This change should be in a separate patch. Instead of removing the 
warning, you should rather use dev_err() or dev_warn() from [1]. Not 
being able to shut down here looks like a serious driver bug that the 
user should know about.


>   }
>   
>   static const struct of_device_id drm_match_table[] = {
> diff --git a/drivers/gpu/drm/sprd/sprd_dsi.c b/drivers/gpu/drm/sprd/sprd_dsi.c
> index 911b3cddc..955c5995a 100644
> --- a/drivers/gpu/drm/sprd/sprd_dsi.c
> +++ b/drivers/gpu/drm/sprd/sprd_dsi.c
> @@ -907,6 +907,9 @@ static int sprd_dsi_context_init(struct sprd_dsi *dsi,
>   	struct resource *res;
>   
>   	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> +	if (!res)
> +		return -EINVAL;
> +

Again, an error message seems appropriate.

Best regards
Thomas

[1] 
https://elixir.bootlin.com/linux/latest/source/include/linux/dev_printk.h#L145

>   	ctx->base = devm_ioremap(dev, res->start, resource_size(res));
>   	if (!ctx->base) {
>   		drm_err(dsi->drm, "failed to map dsi host registers\n");

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20220111/83c60847/attachment.sig>